vendor:
the_kroax
by:
FasTWORM
7.5
CVSS
HIGH
SQL Injection
89
CWE
Product Name: the_kroax
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: NO
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2009
PHP-Fusion Mod the_kroax (comment_id) SQL Injection Vulnerability
An attacker can exploit this vulnerability by sending a specially crafted HTTP request to the vulnerable application. The attacker can inject arbitrary SQL code in the vulnerable parameter 'comment_id' of the 'callcomments.php' script. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. This can be exploited to disclose the content of the database, modify data, delete data, or exploit further vulnerabilities.
Mitigation:
Input validation should be used to prevent SQL injection attacks. The application should sanitize all user-supplied input to prevent SQL injection attacks.
