vendor:
Game
by:
Err0R
7,5
CVSS
HIGH
SQL Injection
89
CWE
Product Name: Game
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: N/A
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
N/A
ProArcadeScript to Game (game) SQL Injection Vulnerability
An attacker can inject malicious SQL queries into the vulnerable parameter 'id' of the 'game.php' script. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. An example of a malicious URL is http://server/games/game.php?id=-999+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19--
Mitigation:
Input validation should be used to prevent SQL injection attacks. Sanitize all user input to ensure that it conforms to the expected format, using whitelists to define all allowed inputs.
