vendor:
pnFlashGames Module
by:
xoron
5.5
CVSS
MEDIUM
Remote SQL Injection
89
CWE
Product Name: pnFlashGames Module
Affected Version From: 1.5
Affected Version To: 1.5
Patch Exists: NO
Related CWE:
CPE:
Platforms Tested:
2007
PostNuke pnFlashGames Module v1.5 Remote SQL Injection
The vulnerability allows an attacker to inject SQL commands into the application's database. By manipulating the 'cid' parameter in the 'index.php?module=pnFlashGames&func=view' URL, an attacker can perform a union-based SQL injection and extract sensitive information from the database.
Mitigation:
To mitigate this vulnerability, developers should use parameterized queries or prepared statements to prevent SQL injection attacks. Additionally, input validation and sanitization should be implemented to ensure that user-supplied data is properly handled.
