BugTraq
[eVuln.com] report.cgi SQL inj in Hot Links SQL (CGI version) Nov 22 2010 11:15AM
bt evuln com
New eVuln Advisory:

report.cgi SQL inj in Hot Links SQL

http://evuln.com/vulns/141/summary.html

-----------Summary-----------

eVuln ID: EV0141

Software: Hot Links SQL 3

Vendor: Mrcgiguy

Version: 3.2.0

Critical Level: medium

Type: SQL injection

Status: Unpatched. No reply from developer(s)

PoC: Available

Solution: Not available

Discovered by: Aliaksandr Hartsuyeu ( http://evuln.com/ )

--------Description--------

SQL injection found in id parameter of report.cgi script. This can be used to make any SQL query by injecting arbitrary SQL code.

This vulnerability found in CGI version of Hot Links SQL 3.

--------PoC/Exploit--------

PoC code is available at http://evuln.com/vulns/141/exploit.html

---------Solution----------

Not available

----------Credit-----------

Vulnerability discovered by Aliaksandr Hartsuyeu

http://evuln.com/tool/web-security.html - Web Security Analyzer

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus