vendor:
Voovi Social Networking Script
by:
Ihsan Sencan
7.5
CVSS
HIGH
SQL Injection
89
CWE
Product Name: Voovi Social Networking Script
Affected Version From: 1.0
Affected Version To: 1.0
Patch Exists: NO
Related CWE: N/A
CPE: a:adminspoint:voovi:1.0
Metasploit:
N/A
Other Scripts:
N/A
Platforms Tested: WiN7_x64/KaLiLinuX_x64
2018
Voovi Social Networking Script 1.0 – ‘user’ SQL Injection
An attacker can exploit a SQL injection vulnerability in Voovi Social Networking Script 1.0. The vulnerability exists due to insufficient sanitization of user-supplied input in the 'user' parameter of the '/[PATH]/' script. A remote attacker can send a specially crafted request to the vulnerable script and execute arbitrary SQL commands in application's database. This can allow the attacker to steal sensitive data from the database.
Mitigation:
Input validation should be used to prevent SQL injection attacks. All user-supplied input should be validated and filtered before being passed to the database layer. It is also recommended to use prepared statements with parameterized queries to prevent SQL injection.
