Thatware 0.4.6 SQL Injection

2016.10.14

Credit: Besim

Risk: Medium

Local: No

Remote: Yes

CVE: N/A

CWE: CWE-89

# Exploit Title :----------------- : Thatware 0.4.6 - (friend.php) - SQL Injection
# Author :------------------------ : Besim
# Google Dork :---------------- : -
# Date :-------------------------- : 13/10/2016
# Type :-------------------------- : webapps
# Platform : -------------------- : PHP
# Vendor Homepage :------- : -
# Software link : -------------- : https://www.exploit-db.com/apps/13132b3e0eaeffc3fad55fded9e5bdc6-thatware_0.4.6.tar.gz
############################ SQL INJECTION Vulnerabilty ############################
*-* Code *-*
include ("header.php");
$result=mysql_query("select title from stories where sid=$sid")
*-* Vulnerable parameter-: $sid
*-* File-----------------: friend.php?sid=(SQL inj)

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

Thatware 0.4.6 SQL Injection

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.