vendor:
Fast FAQs System
by:
x0r
7.5
CVSS
HIGH
SQL Injection
89
CWE
Product Name: Fast FAQs System
Affected Version From:
Affected Version To:
Patch Exists: NO
Related CWE:
CPE:
Platforms Tested:
2009
Bug In admin authorize.php
The vulnerability exists in the 'authorize.php' file of the Fast FAQs System. It allows an attacker to inject malicious SQL code into the 'userid' and 'pass' parameters, potentially bypassing authentication and gaining unauthorized access to the admin panel. The provided exploit payload 'or '1=1' demonstrates the SQL injection attack.
Mitigation:
To mitigate this vulnerability, the application should use prepared statements or parameterized queries to handle user input securely. Input validation and proper sanitization of user-supplied data are essential to prevent SQL injection attacks.
