vendor:
Sendy
by:
Hurley
9,3
CVSS
HIGH
SQL Injection
89
CWE
Product Name: Sendy
Affected Version From: 1.1.8.4
Affected Version To: 1.1.8.4
Patch Exists: YES
Related CWE: N/A
CPE: a:sendy:sendy:1.1.8.4
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2014
Sendy SqlInject
This vulnerability allows an attacker to inject malicious SQL code into the application. The attacker can use the ‘union all select’ statement to retrieve data from the database. The attacker can also use the ‘@@version’ statement to retrieve the version of the database.
Mitigation:
The application should use parameterized queries to prevent SQL injection attacks.
