PHPMyRing IDSITE SQL Injection Vulnerability
BID:19456
CVE-2006-4114 |Info
PHPMyRing IDSITE SQL Injection Vulnerability
| Bugtraq ID: | 19456 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 10 2006 12:00AM |
| Updated: | Aug 11 2006 12:40AM |
| Credit: | Simo64 is credited with the discovery of this vulnerability. |
| Vulnerable: |
PHPMyRing PHPMyRing 4.2 |
| Not Vulnerable: | |
Discussion
PHPMyRing IDSITE SQL Injection Vulnerability
PHPMyRing is prone to an SQL-injection vulnerability because it fails to properly sanitize user-supplied input before using it in an SQL query.
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.
PHPMyRing 4.2.0 and prior versions are reported to be affected.
PHPMyRing is prone to an SQL-injection vulnerability because it fails to properly sanitize user-supplied input before using it in an SQL query.
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.
PHPMyRing 4.2.0 and prior versions are reported to be affected.
Exploit / POC
PHPMyRing IDSITE SQL Injection Vulnerability
Attackers can exploit this issue via a web client.
An example URI has been provided:
Attackers can exploit this issue via a web client.
An example URI has been provided:
Solution / Fix
PHPMyRing IDSITE SQL Injection Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]:[email protected].
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]:[email protected].