vendor:
Topliste Module
by:
xoron
7.5
CVSS
HIGH
Remote SQL Injection
89
CWE
Product Name: Topliste Module
Affected Version From:
Affected Version To:
Patch Exists: NO
Related CWE:
CPE:
Platforms Tested:
2007
PHP-FUSION topliste Module (cid) Remote SQL Injection Vuln
The vulnerability allows an attacker to perform a remote SQL injection by manipulating the 'cid' parameter in the 'index.php' file. The exploit uses a UNION SELECT statement to extract sensitive information from the 'fusion_users' table, including usernames and passwords.
Mitigation:
To mitigate this vulnerability, it is recommended to sanitize and validate user input before using it in SQL queries. Additionally, keeping the PHP-FUSION installation up to date with the latest patches and security updates can help prevent such vulnerabilities.
