vendor:
N/A
by:
Mr.SQL
7.5
CVSS
HIGH
SQL Injection
89
CWE
Product Name: N/A
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: NO
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2009
Remote SQL Injection Vulnerability ( download.php cat_id )
An attacker can exploit this vulnerability by sending a crafted HTTP request to the vulnerable application. The attacker can inject malicious SQL code in the 'cat_id' parameter of the 'download.php' script. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. This may allow the attacker to disclose sensitive information from the database, modify data, compromise the system, etc.
Mitigation:
Input validation should be used to prevent SQL injection attacks. The application should also use stored procedures and parameterized queries to prevent SQL injection attacks.
