vendor:
MyT-PM
by:
Mehmet Önder Key
8.8
CVSS
HIGH
SQL Injection
89
CWE
Product Name: MyT-PM
Affected Version From: 1.5.1
Affected Version To: 1.5.1
Patch Exists: NO
Related CWE: N/A
CPE: 2.3:a:myt:myt_pm:1.5.1
Metasploit:
N/A
Other Scripts:
N/A
Platforms Tested: WAMPP @Win
2019
MyT-PM 1.5.1 – ‘Charge[group_total]’ SQL Injection
An attacker can access all data following an un/authorized user login using the parameter. The payloads used are Error Based, Time-Based Blind and Stacked Queries.
Mitigation:
Input validation and sanitization should be done to prevent SQL Injection attacks.
