vendor:
FAQ Manager Pro
by:
Mountassif Moad
9
CVSS
HIGH
Blind Sql Injection
89
CWE
Product Name: FAQ Manager Pro
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: YES
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2008
Ocean12 FAQ Manager Pro
The vulnerability is a Blind SQL Injection vulnerability which can be exploited by sending a crafted HTTP request with a malicious payload. The malicious payload can be sent in the form of a URL parameter, such as 'site.com/?Action=Cat&ID=40%20and%201=1 true' or 'site.com/?Action=Cat&ID=40%20and%201=0 false'. This can be exploited using automated tools such as sqlmap.
Mitigation:
Input validation should be used to prevent malicious payloads from being sent in the form of URL parameters. Additionally, automated tools such as sqlmap can be used to detect and prevent Blind SQL Injection vulnerabilities.
