vendor:
Submitter Script 2
by:
ThE g0bL!N
7,5
CVSS
HIGH
SQL Injection
89
CWE
Product Name: Submitter Script 2
Affected Version From: 2.0
Affected Version To: 2.0
Patch Exists: NO
Related CWE: N/A
CPE: submitterscript.com
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2009
Submitter Script 2(Auth Bypass) SQL Injection Vulnerability
An authentication bypass vulnerability exists in Submitter Script 2, which allows an attacker to gain access to the admin panel without valid credentials. This is due to the application not properly sanitizing user-supplied input before using it in an SQL query. An attacker can exploit this vulnerability by supplying a specially crafted username and password, such as ' or '1=1. This will cause the application to bypass authentication and grant the attacker access to the admin panel.
Mitigation:
Input validation should be used to ensure that untrusted data is not used to construct SQL queries in a way that would allow an attacker to modify the logic of the executed query.
