vendor:
Business Survey Pro
by:
G4N0K
7.5
CVSS
HIGH
Remote SQL Vulnerability
89
CWE
Product Name: Business Survey Pro
Affected Version From: 1
Affected Version To: 1
Patch Exists: NO
Related CWE: N/A
CPE: a:turnkeyforms:business_survey_pro
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2008
Business Survey Pro 1.0 (survey_results_text.php id) Remote SQL Vulnerability
Business Survey Pro 1.0 is vulnerable to a Remote SQL Injection vulnerability. This vulnerability allows an attacker to inject malicious SQL queries into the vulnerable application. The vulnerable parameter is the 'id' parameter in the survey_results_text.php file. An attacker can exploit this vulnerability by sending a malicious SQL query to the vulnerable parameter. The malicious query can be used to extract sensitive information from the database such as usernames and passwords.
Mitigation:
The best way to mitigate this vulnerability is to validate user input and sanitize it before passing it to the database. Additionally, the application should be configured to use parameterized queries.
