vendor:
Flexphpsiteen CMS
by:
x0r
7.5
CVSS
HIGH
SQL Injection
89
CWE
Product Name: Flexphpsiteen CMS
Affected Version From: 0.0.1
Affected Version To: 0.0.1
Patch Exists: NO
Related CWE:
CPE:
Platforms Tested:
2008
Flexphpsiteen CMS SQL Injection Vulnerability
The vulnerability exists in the usercheck.php file of the Flexphpsiteen CMS. By manipulating the 'username' and 'password' parameters, an attacker can inject malicious SQL code and bypass authentication. The provided exploit code demonstrates the use of a common SQL injection technique by using the payload ' or '1=1' to always evaluate to true, granting unauthorized access to the admin panel.
Mitigation:
To mitigate this vulnerability, the developer should implement proper input validation and parameterized queries to prevent SQL injection attacks. It is recommended to update to a patched version of the CMS if available.
