PHP Prayer Board SQL Injection Vulnerability

Bugtraq ID:	8774
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 06 2003 12:00AM
Updated:	Oct 06 2003 12:00AM
Credit:	This vulnerability was announced in a vendor changelog.
Vulnerable:	PHP Prayer Board PHP Prayer Board 0.51
Not Vulnerable:	PHP Prayer Board PHP Prayer Board 0.52

PHP Prayer Board SQL Injection Vulnerability

PHP Prayer board has been reported prone to an SQL Injection vulnerability. The issue has been reported to present itself due to a lack of sufficient sanitization performed on user-supplied data. It has been reported that an attacker may submit form data or URI parameters containing malicious SQL code to the pages 'prayerboard.php' and 'prayerboard_db.php', in order to influence PHP Prayer board SQL query logic.

Ultimately, an attacker may exploit this vulnerability to insert SQL code into PHP Prayer board SQL requests and have the SQL code executed by the underlying database server.

PHP Prayer Board SQL Injection Vulnerability

This vulnerability may be exploited using a web browser.

PHP Prayer Board SQL Injection Vulnerability

Solution:
The vendor has released an update to address this issue:


PHP Prayer Board PHP Prayer Board 0.51

• PHP Prayer Board phpprayboard-0.52.tar.bz2
  http://prdownloads.sourceforge.net/phpprayerboard/phpprayboard-0.52.ta r.bz2?download

PHP Prayer Board SQL Injection Vulnerability

References:

• PHP Prayer Board Changelog (PHP Prayer Board)
  
• PHP Prayer Board Homepage (PHP Prayer Board)