vendor:
PG Roommate
by:
SecurityFocus
7.5
CVSS
HIGH
SQL Injection
89
CWE
Product Name: PG Roommate
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: No
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2008
PG Roommate is prone to an SQL-injection vulnerability
PG Roommate is vulnerable to an SQL injection attack due to insufficient sanitization of user-supplied data before using it in an SQL query. An attacker can exploit this vulnerability to gain access to the application, modify data, or exploit latent vulnerabilities in the underlying database. A proof of concept is available, where an attacker can use the username "admin ' or ' 1=1--" and any password to gain access.
Mitigation:
Input validation should be used to ensure that user-supplied data is properly sanitized before being used in an SQL query.
