Webify Link Directory 'id' Parameter SQL Injection Vulnerability

Bugtraq ID:	54310
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 04 2012 12:00AM
Updated:	Jul 04 2012 12:00AM
Credit:	Daniel Godoy
Vulnerable:	Webify Link Directory 0
Not Vulnerable:

Webify Link Directory 'id' Parameter SQL Injection Vulnerability

Webify Link Directory is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Webify Link Directory 'id' Parameter SQL Injection Vulnerability

An attacker can exploit the issue using a browser.

The following example URI is available:

http://www.example.com/index.php?page=browse&id=1' AND SLEEP(0) AND 'chap'='chap

Webify Link Directory 'id' Parameter SQL Injection Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Webify Link Directory 'id' Parameter SQL Injection Vulnerability

References:

• Webify Link Directory Homepage (Webify)