By : s3rv3r_hack3r (Ali Jasbi)

Vendor : abk-soft.com

Name : ablespace

version : All Version

Risk : Very high

++++++++++++++++++++++++++++++++++++++++++++

adv_cat.php >>>

if(!empty($_GET['cat_id'])){

$str = '';

DB::query("select * from adv_cats where id=".to_sql(get_param('cat_id'),"Number"));

++++++++++++++++++++++++++++++++++++++++++++

You can exploit this vulnerability like this :

Http://domainname.com/ablespace/adv_cat.php?cat_id=[sql inection]

[ reply ]