vendor:
EQdkp
by:
Silentz
7.5
CVSS
HIGH
SQL Injection
89
CWE
Product Name: EQdkp
Affected Version From: 1
Affected Version To: 1.3.2002
Patch Exists: NO
Related CWE:
CPE:
Platforms Tested:
EQdkp <= 1.3.2 SQL Injection Exploit
This exploit allows an attacker to retrieve the admin username and hash from the EQdkp <= 1.3.2 application. The vulnerability exists in the listmembers.php file, where user input is not properly sanitized before being used in an SQL query. By injecting malicious SQL code through the 'rank' parameter in the URL, an attacker can retrieve sensitive information from the database.
Mitigation:
To mitigate this vulnerability, it is recommended to sanitize user input before using it in SQL queries. Additionally, implementing proper access controls and authentication mechanisms can help prevent unauthorized access to sensitive information.
