vendor:
Insanely Simple Blog
by:
unohope
7.5
CVSS
HIGH
SQL Injection
89
CWE
Product Name: Insanely Simple Blog
Affected Version From: 0.5
Affected Version To: 0.5
Patch Exists: NO
Related CWE: N/A
CPE: a:insanely_simple_blog:insanely_simple_blog
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2008
Insanely Simple Blog 0.5 (index) Remote SQL Injection Vulnerabilities
Insanely Simple Blog 0.5 is vulnerable to remote SQL injection attacks. An attacker can exploit this vulnerability to gain access to sensitive information such as usernames and passwords stored in the database. The vulnerability is due to insufficient sanitization of user-supplied input in the 'id' and 'current_subsection' parameters of the 'index.php' script. An attacker can exploit this vulnerability by sending a specially crafted HTTP request containing malicious SQL statements to the vulnerable script. Successful exploitation of this vulnerability can result in unauthorized access to the database.
Mitigation:
Input validation should be used to ensure that user-supplied input is properly sanitized before being used in SQL statements. Additionally, the application should be configured to use the least privileged account with access to the database.
