vendor:
Saman Portal
by:
Pouya Daneshmand
8,8
CVSS
HIGH
SQL Injection
89
CWE
Product Name: Saman Portal
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: NO
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2018
Saman Portal SQL Injection Vulnerability
A SQL injection vulnerability was discovered in Saman Portal, which allows an attacker to execute arbitrary SQL commands on the vulnerable system. The vulnerability exists due to insufficient sanitization of user-supplied input in the 'pageid' parameter of the 'index.php' script. An attacker can exploit this vulnerability by sending a specially crafted HTTP request containing malicious SQL commands to the vulnerable script. This can allow the attacker to gain access to sensitive information stored in the database, modify data, execute administration operations on the database, and compromise the system.
Mitigation:
Input validation should be used to prevent SQL injection attacks. All user-supplied input should be validated and filtered before being used in SQL queries.
