RSS Feed
TwitterPhp City Portal Script Software SQL Injection
############################################################################# Exploit Title: *Php City Portal Script Software SQL Injection* |
# Google Dork: *Powered by PHPCityPortal.com* |
# Date: *Decembar/07/2011* |
# Author: *Don (BalcanCrew & BalcanHack)* |
# Software Link: *http://phpcityportal.com* |
# Version: *1.1* |
# Tested on: *Apache (Unix)* |
# An attacker may execute arbitrary SQL statements on the vulnerable system. |
# This may compromise the integrity of your database and/or expose |
sensitive information. |
############################################################################ |
*Attack details:* |
URL encoded GET input userName was set to *1'* |
Error message found: supplied argument is not a valid MySQL result |
Vulnerability: |
*http://localhost/phpcityportal/profile.php?userName= (SQL)* |
*How to fix this vulnerability:* |
Filter metacharacters from user input. |
*NOTE!* |
*You have to be logged in!* |
~Don 2011
0 Response to "Php City Portal Script Software SQL Injection"
Post a Comment