PHP Labs Top Auction Multiple SQL Injection Vulnerabilities
BID:15547
Info
PHP Labs Top Auction Multiple SQL Injection Vulnerabilities
| Bugtraq ID: | 15547 |
| Class: | Input Validation Error |
| CVE: |
CVE-2005-3952 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 23 2005 12:00AM |
| Updated: | May 07 2015 06:23PM |
| Credit: | r0t is credited with the discovery of these vulnerabilities. |
| Vulnerable: |
PHP Labs Top Auction PHP Labs Survey Wizard |
| Not Vulnerable: | |
Discussion
PHP Labs Top Auction Multiple SQL Injection Vulnerabilities
PHP Labs Top Auction is prone to multiple SQL-injection vulnerabilities because the application failso properly sanitize user-supplied input before using it in an SQL query.
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.
PHP Labs Top Auction is prone to multiple SQL-injection vulnerabilities because the application failso properly sanitize user-supplied input before using it in an SQL query.
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.
Exploit / POC
PHP Labs Top Auction Multiple SQL Injection Vulnerabilities
No exploit is required.
Proof-of-concept examples have been provided:
http://www.example.com/viewcat.php?category=[SQL]
http://www.example.com/viewcat.php?category=3&type=[SQL]
No exploit is required.
Proof-of-concept examples have been provided:
http://www.example.com/viewcat.php?category=[SQL]
http://www.example.com/viewcat.php?category=3&type=[SQL]
Solution / Fix
PHP Labs Top Auction Multiple SQL Injection Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
PHP Labs Top Auction Multiple SQL Injection Vulnerabilities
References:
References:
- PHP Labs Survey Wizard survey.php SQL injection (rakstija r0t3d3Vil)
- PHP Labs Top Auction viewcat.php SQl injection (rakstija r0t3d3Vil)
- PHP Labs Top Auction Web Site (PHP Labs )
- PHP Labs Web Site (PHP Labs)