 |
|
|
|
| Vulnerability details : |
| |
 |
|
Kostenloses Linkmanagementscript view.php id Parameter SQL Injection |
|
|
Fiche créée le 2008-05-16 20:36:12, dernière mise à jour le 2009-10-23 05:58:53
Kostenloses Linkmanagementscript contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'view.php' script not properly sanitizing user-supplied input to the 'id' variable. This may allow an attacker to inject or manipulate SQL queries in the back-end database.
This vulnerability is only present when the magic_quotes_gpc PHP option is 'off'.
http://[target]/[path]/view.php?id='/**/union/**/select/**/now(),load_file(0x2f6574632f706173737764)/**/from/**/mysql.user/*
|
| |
| |
| |
| External refs : |
| OSVDB 45224 |
| |
| |
| |
| |
|
|
|
|
| Free consultation (search) |
|
|
|
|
|
| |
|
|
|
