vendor:
webSPELL
by:
Unknown
7.5
CVSS
HIGH
SQL Injection
89
CWE
Product Name: webSPELL
Affected Version From: webSPELL v4.01.02
Affected Version To:
Patch Exists: NO
Related CWE:
CPE:
Platforms Tested:
webSPELL v4.01.02 gallery.php SQL Injection
This exploit allows an attacker to perform SQL injection in the gallery.php file of webSPELL v4.01.02. By manipulating the parameters, the attacker can retrieve the password from the user table.
Mitigation:
To mitigate this vulnerability, it is recommended to update to a newer version of webSPELL that includes a fix for this SQL injection issue. Additionally, input validation and parameterized queries should be implemented to prevent SQL injection attacks.