vendor:
AKY Blog
by:
Madconfig
8,8
CVSS
HIGH
SQL Injection
89
CWE
Product Name: AKY Blog
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: NO
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2020
AKY Blog SQL İnjection
A SQL injection vulnerability exists in the AKY Blog script, which allows an attacker to execute arbitrary SQL commands on the vulnerable system. The vulnerability is due to the lack of proper input validation in the ‘default.asp’ script, which allows an attacker to inject malicious SQL commands via the ‘islem’ and ‘id’ parameters. An attacker can exploit this vulnerability to gain access to sensitive information, such as passwords, from the vulnerable system.
Mitigation:
Input validation should be implemented to prevent SQL injection attacks. Additionally, the application should be configured to use parameterized queries to prevent SQL injection attacks.
