Previous articleBack to news listNext article
|
Sponsored links |
Want to become one of our authors and see your work published on ALLSeek.iNFO ?
|
| phpBB Input Validation Flaw in 'profile.php' Lets Remote Users Inject SQL Commands |
|---|
Categorie: Vulnerability
Posted: 2003-11-11 by ReCall
Views: 452
Source: Click here
| Current Rating: Not rated
|
|
| Details |
|---|
Description: An input validation vulnerability was reported in phpBB. A remote user can inject SQL commands.
It is reported that the 'profile.php' script does not validate the user id variable 'u' when attempting to display a registered user's profile. A remote user can submit a specially crafted HTTP GET request to inject SQL commands to be executed by the underlying database.
A demonstration exploit URL is provided:
http://[target]/profile.php?mode=viewprofile&u='[sqlcode]
Impact: A remote user can inject SQL commands to be executed by the underlying database.
Solution: The report indicates that version 2.0.7 is not affected.
|
| Syndication |
|---|
Permalink Email this
The URI to TrackBack this entry is:
http://allseek.info/news/trackback.php?id=522
|
| User comments (post your comments ) |
|---|
Only registerd members can post comments and articles
|
|
Previous articleBack to news listNext article
|
