[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: SQL Injection in phpMySport
: Vulnerability ID: HTB22770
: Reference: http://www.htbridge.ch/advisory/sql_injection_in_phpmysport.html
: Vulnerability Details:
: The vulnerability exists due to failure in the "/index.php" script to
: properly sanitize user-supplied input in "v1" variable. Attacker can
: alter queries to the application SQL database, execute arbitrary queries
: to the database, compromise the application, access or modify sensitive
: data, or exploit various vulnerabilities in the underlying SQL database.
Multiple SQL injection vulnerabilities in index.php in phpMySport 1.4,
when magic_quotes_gpc is disabled, allow remote attackers to execute
arbitrary SQL commands via the [..] (2) v1 parameter in a news action,
1. You kids can't seem to search a VDB before posting. This was disclosed
2009-03-12 and assigned CVE-2010-1109.
2. As usual, you leave of important technical details such as the
requirement of magic_quotes_gpc to be disabled.
3. Predictably, other advisories fall under this. Splitting
advisories out like this doesn't fool anyone you know..
Both of these are also covered under CVE-2010-1109.