vendor:
AdManager 4 (group)
by:
Hussin X
7.5
CVSS
HIGH
Blind SQL Injection
89
CWE
Product Name: AdManager 4 (group)
Affected Version From: 4
Affected Version To: 4
Patch Exists: NO
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2008
E-topbiz AdManager 4 (group) Blind SQL Injection Vulnerability
A Blind SQL Injection vulnerability was discovered in E-topbiz AdManager 4 (group). An attacker can exploit this vulnerability to gain access to the database and execute arbitrary SQL commands. The vulnerability exists due to insufficient sanitization of user-supplied input in the 'group' parameter of the 'view.php' script. An attacker can exploit this vulnerability by sending a specially crafted HTTP request with malicious SQL code to the vulnerable script. Successful exploitation of this vulnerability can result in unauthorized access to the database and execution of arbitrary SQL commands.
Mitigation:
Input validation should be used to prevent SQL injection attacks. All input data should be validated and filtered before passing to the database. It is also recommended to use stored procedures and parameterized queries to prevent SQL injection attacks.
