vendor:
elkagroup
by:
SadHaCkEr
9
CVSS
HIGH
SQL Injection
89
CWE
Product Name: elkagroup
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: NO
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2020
elkagroup SQL Injection Vulnerability (Iranian Script)
A SQL injection vulnerability exists in elkagroup, which allows an attacker to execute arbitrary SQL commands on the underlying database. The vulnerability is due to insufficient input validation of the 'id' parameter in the 'news' page. An attacker can exploit this vulnerability by sending a specially crafted HTTP request containing malicious SQL commands to the vulnerable server. Successful exploitation of this vulnerability can allow an attacker to gain unauthorized access to sensitive information stored in the database.
Mitigation:
Input validation should be performed to ensure that user-supplied data is properly sanitized before being used in SQL queries. Additionally, the application should use parameterized queries to prevent SQL injection attacks.
