vendor:
City Directory Review and Rating Script
by:
3spi0n
8,8
CVSS
HIGH
SQL Injection [MySQLi]
89
CWE
Product Name: City Directory Review and Rating Script
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: NO
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: Ubuntu 12.10, Win7
2012
City Directory Review and Rating Script SQL Injection
City Directory Review and Rating Script is vulnerable to SQL Injection. The vulnerability exists in the 'search.php' page, where user-supplied input is not properly sanitized before being used in a SQL query. An attacker can exploit this vulnerability to gain access to the database and execute arbitrary SQL commands.
Mitigation:
Input validation should be used to ensure that untrusted data is not used to construct SQL queries in an unsafe manner. Parameterized queries should be used to prevent SQL injection attacks.
