vendor:
MyCustomers
by:
Persian Hack Team
7,5
CVSS
HIGH
SQL Injection
89
CWE
Product Name: MyCustomers
Affected Version From: 1.3
Affected Version To: 1.3
Patch Exists: NO
Related CWE: None
CPE: a:iran-php:mycustomers
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: None
2015
MyCustomers Cms Sql Injection Vulnerability
MyCustomers CMS is vulnerable to SQL injection. An attacker can exploit this vulnerability by sending malicious SQL queries to the vulnerable parameter DPT. This can be done by appending a single quote character to the vulnerable parameter. For example, http://server/index.php?DPT=IP17%27. This can allow an attacker to gain access to the database and potentially execute arbitrary code.
Mitigation:
The vendor should patch the vulnerability by properly sanitizing user input.
