vendor:
PHPRecipeBook
by:
DarKdewiL
9
CVSS
HIGH
SQL Injection
89
CWE
Product Name: PHPRecipeBook
Affected Version From: 2.39
Affected Version To: 2.39
Patch Exists: NO
Related CWE: N/A
CPE: a:phprecipebook:phprecipebook
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2009
PHPRecipeBook Remote SQL Injection Exploit
A remote SQL injection vulnerability exists in PHPRecipeBook 2.39. An attacker can exploit this vulnerability to inject malicious SQL queries into the application, allowing them to gain access to sensitive information stored in the database. The vulnerability is due to insufficient sanitization of user-supplied input to the 'course_id' parameter of the 'index.php' script. An attacker can exploit this vulnerability by sending a specially crafted HTTP request containing malicious SQL statements to the vulnerable application. Successful exploitation of this vulnerability can result in unauthorized access to sensitive information stored in the database.
Mitigation:
Input validation should be used to ensure that user-supplied input is properly sanitized. Additionally, the application should be configured to use the least privileged user account with the least amount of privileges necessary to perform its intended function.
