Tr Script News 'news.php' SQL Injection Vulnerability
BID:28876
Info
Tr Script News 'news.php' SQL Injection Vulnerability
| Bugtraq ID: | 28876 |
| Class: | Input Validation Error |
| CVE: |
CVE-2008-1957 |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 21 2008 12:00AM |
| Updated: | May 07 2015 05:29PM |
| Credit: | His0k4 |
| Vulnerable: |
Tr Script News Tr Script News 2.1 |
| Not Vulnerable: | |
Discussion
Tr Script News 'news.php' SQL Injection Vulnerability
Tr Script News is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Tr Script News 2.1 is vulnerable; other versions may also be affected.
Tr Script News is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Tr Script News 2.1 is vulnerable; other versions may also be affected.
Exploit / POC
Tr Script News 'news.php' SQL Injection Vulnerability
Attackers can use a browser to exploit this issue.
The following exploit is available:
http://www.example.com/[news_path]/news.php?mode=voir&nb=[SQL]
Attackers can use a browser to exploit this issue.
The following exploit is available:
http://www.example.com/[news_path]/news.php?mode=voir&nb=[SQL]
Solution / Fix
References
Tr Script News 'news.php' SQL Injection Vulnerability
References:
References:
- Tr Script News Homepage (Tr Script News)