vendor:
ComicShout Remote
by:
D3m0n a.k.a Niiub
7.5
CVSS
HIGH
SQL Injection
89
CWE
Product Name: ComicShout Remote
Affected Version From: 2.5
Affected Version To: 2.5
Patch Exists: YES
Related CWE: N/A
CPE: a:comicshout:comicshout_remote:2.5
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2008
ComicShout Remote 2.5 SQL Injection Vulnerability
A SQL injection vulnerability exists in ComicShout Remote 2.5, which allows an attacker to execute arbitrary SQL commands via the 'comic_id' parameter in the 'index.php' script. An attacker can exploit this vulnerability to gain access to the admin panel by using the '/index.php?comic_id=-1+UNION+SELECT+1,2,3,concat(site_admin,char(58),site_pass),5,6+FROM+setup/*' exploit.
Mitigation:
Upgrade to the latest version of ComicShout Remote 2.5 or apply the patch provided by the vendor.
