vendor:
jPORTAL 2
by:
Kacper
7.5
CVSS
HIGH
Remote SQL Injection
89
CWE
Product Name: jPORTAL 2
Affected Version From: jPORTAL 2
Affected Version To: jPORTAL 2
Patch Exists: NO
Related CWE:
CPE:
Platforms Tested:
2007
jPORTAL 2 Remote SQL Injection Vulnerability
The vulnerability allows an attacker to execute SQL queries on the jPORTAL 2 mailer.php page. By injecting a malicious SQL query, an attacker can retrieve sensitive information, such as usernames and passwords, from the admins table. The exploit can be executed by appending a union select statement to the 'to' parameter in the URL.
Mitigation:
To mitigate this vulnerability, it is recommended to sanitize user input and use prepared statements or parameterized queries to prevent SQL injection attacks.
