vendor:
Autoreminder
by:
ZoRLu
7.5
CVSS
HIGH
SQL Injection
89
CWE
Product Name: Autoreminder
Affected Version From: 3.7
Affected Version To: 3.7
Patch Exists: NO
Related CWE: N/A
CPE: a:plx_web_dev:autoreminder
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2009
plx Autoreminder v3.7 (id) R-Sql Injection
An SQL injection vulnerability in plx Autoreminder v3.7 allows an attacker to execute arbitrary SQL commands via the 'id' parameter in the 'members.php' script. An attacker can use the 'concat()' function to extract the username, version, and database of the application. The attacker can also use the 'union select' statement to extract data from the database.
Mitigation:
Input validation should be used to prevent SQL injection attacks.
