AutoRank PHP < 2.0.4 - SQL Injection (PoC)

AutoRank PHP < 2.0.4 – SQL Injection (PoC)

漏洞ID 1054305 漏洞类型
发布时间 2003-12-18 更新时间 2003-12-18
图片[1]-AutoRank PHP < 2.0.4 - SQL Injection (PoC)-安全小百科CVE编号 N/A
图片[2]-AutoRank PHP < 2.0.4 - SQL Injection (PoC)-安全小百科CNNVD-ID N/A
漏洞平台 PHP CVSS评分 N/A
|漏洞来源
https://www.exploit-db.com/exploits/43792
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
AutoRank PHP SQL Injection

Vendor: JMB Software
Product: AutoRank PHP
Version: <= 2.0.4
Website: http://www.jmbsoft.com/

BID: 9251 

Description:
The description as taken from the Autorank website "AutoRank PHP is our next generation toplist software, written completely in PHP and backed by a MySQL database. This software has all the features of the Pro version, and we have added several more which make this the most advanced toplist software available today. We have combined the power and speed of PHP and MySQL to make AutoRank PHP extremely efficient and scalable. A complete list of features is available if you would like to jump right to that. Otherwise, you can continue on and find out why AutoRank PHP is the premier PHP toplist software available today." 

Problem:
Autorank PHP is vulnerable to SQL Injection attacks. The vulnerabilities can be exploited by injecting SQL queries into the user & password fields when editing an account, the email field when requesting a lost password and the username field when registering an account. If a malicious attacker logs in with the username and password '-- he will automatically be given access to the first account cataloged in the database. He can then view the HTML source code to view that users password in plain text. This also leaves the database being used by Autorank PHP open for attack. The affected file is accounts.php 

Credits:
James Bercegay of the GulfTech Security Research Team.

相关推荐: Windows NT 4.0中内核强制关闭处理导致系统崩溃的漏洞

Windows NT 4.0中内核强制关闭处理导致系统崩溃的漏洞 漏洞ID 1206777 漏洞类型 未知 发布时间 1999-12-31 更新时间 1999-12-31 CVE编号 CVE-1999-1360 CNNVD-ID CNNVD-199912-10…

© 版权声明
THE END
喜欢就支持一下吧
点赞0
分享