vendor:
N/A
by:
Hussin X
8.8
CVSS
HIGH
SQL Injection
89
CWE
Product Name: N/A
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: NO
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2008
Scrolling Text Ads (id) Remote SQL Injection Vulnerability
The vulnerability exists due to insufficient sanitization of user-supplied input passed via the 'id' parameter to 'tr1.php' script. A remote attacker can execute arbitrary SQL commands in application's database, inject own SQL commands, read sensitive data from the database, modify or delete data. Successful exploitation requires knowledge of the database structure and may lead to full compromise of the application.
Mitigation:
Input validation should be used to prevent SQL injection attacks. It is recommended to use parameterized queries (prepared statements) when working with databases.
