vendor:
MihanTools Script
by:
WHITE_DEVIL
7.5
CVSS
HIGH
SQL Injection
89
CWE
Product Name: MihanTools Script
Affected Version From: all version
Affected Version To: all version
Patch Exists: NO
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: Windows Sp2
2011
MihanTools Script SQL Injection Vunerability
The vulnerability exists due to insufficient sanitization of user-supplied input in the 'id' parameter of the 'product.php' script. A remote attacker can send a specially crafted request to the vulnerable script and execute arbitrary SQL commands in application's database. This can allow the attacker to steal sensitive information from the database, modify data, deface the site, etc.
Mitigation:
Input validation should be used to prevent SQL injection attacks. All user-supplied input should be validated and filtered before passing it to the database.
