vendor:
BS Auction
by:
Easy Laster
7.5
CVSS
HIGH
SQL Injection
89
CWE
Product Name: BS Auction
Affected Version From:
Affected Version To:
Patch Exists: NO
Related CWE:
CPE:
Platforms Tested:
2010
BS Auction <= SQL Injection Vulnerability Exploit
This exploit targets the BS Auction script and allows for SQL injection through the 'id' parameter in the articlesdetails.php file. The exploit is written in Ruby and requires the host, path, and user ID as input. It was discovered by Easy Laster.
Mitigation:
To mitigate this vulnerability, the developer should implement proper input validation and parameterized queries to prevent SQL injection attacks.
