vendor:
GlobalWebTek Design
by:
cyberlog
8,8
CVSS
HIGH
SQL Injection
89
CWE
Product Name: GlobalWebTek Design
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: NO
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2020
GlobalWebTek Design SQL Injection Vulnerability
The vulnerability exists in the GlobalWebTek Design website, which allows an attacker to inject malicious SQL queries into the vulnerable web application. The vulnerable parameters are 'CAT' and 'famid' in the URLs 'productos.php?CAT=' and 'etalle_productos.php?famid='. An attacker can exploit this vulnerability to gain unauthorized access to the database and manipulate the data.
Mitigation:
The best way to mitigate this vulnerability is to use parameterized queries instead of dynamic SQL queries. This will ensure that the user input is treated as a string and not as a part of the SQL query. Additionally, input validation should be used to ensure that the user input is valid and does not contain any malicious code.
