PhpGedView Remote SQL Injection Vulnerability

vendor:

PhpGedView

by:

SecurityFocus

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: PhpGedView

Affected Version From: 2.65beta5

Affected Version To: 2.65beta5

Patch Exists: YES

Related CWE: N/A

CPE: a:phpgedview:phpgedview

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2005

PhpGedView Remote SQL Injection Vulnerability

It is reported that PhpGedView is susceptible to a remote SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input prior to including it in an SQL query. This issue allows remote attackers to manipulate query logic. The issue could theoretically be exploited to compromise the software by performing unauthorized actions on the database, such as modifying or viewing data. SQL injection attacks may also be used to exploit latent vulnerabilities in the underlying database.

Mitigation:

Input validation should be used to ensure that user-supplied input is properly sanitized prior to being included in an SQL query.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/11925/info

It is reported that PhpGedView is susceptible to a remote SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input prior to including it in an SQL query.

This issue allows remote attackers to manipulate query logic. The issue could theoretically be exploited to compromise the software by performing unauthorized actions on the database, such as modifying or viewing data. SQL injection attacks may also be used to exploit latent vulnerabilities in the underlying database. This may depend on the nature of the query being manipulated as well as the capabilities of the database implementation.

This issue has been reported to effect PhpGedView 2.65beta5 and earlier.

http://www.example.com/phpgedview/timeline.php?pids=[Evil_Query]