vendor:
OpenSupports
by:
indoushka
7,5
CVSS
HIGH
Blind SQL Injection
89
CWE
Product Name: OpenSupports
Affected Version From: 2.0
Affected Version To: 2.0
Patch Exists: NO
Related CWE: N/A
CPE: a:opensupports:opensupports:2.0
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2014
Open Support Blind SQL Injection v2.0 Vulnerability
This vulnerability affects /support/login.php, /support/responder.php and /support/verarticulo.php. An attacker can inject malicious SQL queries into the vulnerable parameters of the application. For example, in /support/login.php, an attacker can inject malicious SQL queries into the emailcorreoelectronico parameter. In /support/responder.php, an attacker can inject malicious SQL queries into the idarticulo and text_content parameters. In /support/verarticulo.php, an attacker can inject malicious SQL queries into the id parameter.
Mitigation:
The application should use parameterized queries to prevent SQL injection attacks.
