vendor:
PHPRecipeBook
by:
d3b4g
7.5
CVSS
HIGH
SQL Injection
89
CWE
Product Name: PHPRecipeBook
Affected Version From: 2.24
Affected Version To: 2.24
Patch Exists: NO
Related CWE: N/A
CPE: a:phprecipebook:phprecipebook
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: Web-based
2009
PHPRecipeBook 2.24 (_id)Remort SQL Injection Vulnerability
PHPRecipeBook is vulnerable to a remote SQL injection vulnerability. An attacker can exploit this vulnerability to gain access to the database and execute arbitrary SQL commands. The vulnerability is due to the lack of proper sanitization of user-supplied input to the 'base_id' parameter in the 'index.php' script. An attacker can exploit this vulnerability by sending a specially crafted HTTP request with malicious SQL statements to the vulnerable application. Successful exploitation of this vulnerability can result in unauthorized access to the database and execution of arbitrary SQL commands.
Mitigation:
Input validation should be used to prevent SQL injection attacks. All user-supplied input should be validated and filtered before being used in SQL queries.
