vendor:
AJ HYIP
by:
Jose Luis Gongora Fernandez (a.k.a) JosS
8,8
CVSS
HIGH
Blind SQL Injection
89
CWE
Product Name: AJ HYIP
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: NO
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2009
AJ HYIP PRIME (welcome.php id) Blind SQL Injection Vulnerability
AJ HYIP PRIME is vulnerable to Blind SQL Injection. This vulnerability can be exploited by sending a maliciously crafted HTTP request to the vulnerable server. An attacker can use this vulnerability to gain access to sensitive information stored in the database, such as usernames and passwords. The vulnerability is caused by the lack of proper input validation of the 'id' parameter in the 'welcome.php' script. An attacker can exploit this vulnerability by sending a specially crafted HTTP request containing malicious SQL code to the vulnerable server. The malicious code will be executed in the context of the web server, allowing the attacker to gain access to sensitive information stored in the database.
Mitigation:
Input validation should be used to prevent malicious SQL code from being executed. Additionally, the web application should be configured to use a least privileged account with limited access to the database.
