| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20060720102332.11315.qmail@securityfocus.com>
Date: 20 Jul 2006 10:23:32 -0000
From: admin@...orsecurity.de
To: bugtraq@...urityfocus.com
Subject: [MajorSecurity #21] phpFaber TopSites <=2.0.9 - SQL Injection
Vulnerability
[MajorSecurity #21] phpFaber TopSites <=2.0.9 - SQL Injection Vulnerability
-----------------------------------------------------------------
Software: phpFaber TopSites
Version: <=2.0.9
Type: SQL Injection Vulnerability
Made public: July, 19th 2006
Vendor: phpFaber, LLC
Page: http://www.phpfaber.com/
Credits:
----------------------------------------------
Discovered by: David "Aesthetico" Vieira-Kurz
http://www.majorsecurity.de
Original Advisory:
----------------------------------------------
http://www.majorsecurity.de/advisory/major_rls21.txt
Affected Products:
----------------------------------------------
phpFaber TopSites 2.0.9 and prior
Description:
----------------------------------------------
phpFaber TopSites is a feature-packed, reliable and secure Top List for webmasters who want to increase traffic to their websites.
It is fully customizable and doesn't require any programming skills! You can create your forms just in 3 clicks!
Vulnerability:
----------------------------------------------
Input passed directly to the "i_cat" and "method" parameter in "index.php" is not properly sanitised before being used in a SQL query.
This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
Solution:
----------------------------------------------
Edit the source code to ensure that input is properly sanitised.
Powered by blists - more mailing lists