vendor:
Binn SBuilder
by:
JosS
8.8
CVSS
HIGH
Blind Sql Injection
89
CWE
Product Name: Binn SBuilder
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: NO
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2020
Binn SBuilder (nid) Remote Blind Sql Injection Vulnerabily
Binn SBuilder is vulnerable to a Blind Sql Injection vulnerability. This vulnerability can be exploited by sending a maliciously crafted HTTP request to the vulnerable application. An attacker can use this vulnerability to extract sensitive information from the database, such as usernames and passwords. The vulnerability exists due to insufficient sanitization of user-supplied input in the 'nid' parameter of the 'full_text.php' script. An attacker can exploit this vulnerability by sending a specially crafted HTTP request containing malicious SQL code to the vulnerable application. The malicious SQL code can be used to extract sensitive information from the database, such as usernames and passwords.
Mitigation:
Input validation should be used to ensure that user-supplied input is properly sanitized. Additionally, the application should be configured to use parameterized queries to prevent SQL injection attacks.
