vendor:
PHP Realty Script
by:
v3n0m
7,5
CVSS
HIGH
SQL Injection
89
CWE
Product Name: PHP Realty Script
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: NO
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2010
YPNinc PHP Realty Script (docID) SQL Injection Vulnerability
A vulnerability exists in YPNinc PHP Realty Script, which allows an attacker to inject arbitrary SQL commands via the docID parameter in dpage.php. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code in the docID parameter, resulting in the manipulation of the underlying database. This can be used to gain access to sensitive information such as usernames and passwords.
Mitigation:
Input validation should be used to prevent SQL injection attacks. The application should also be configured to use the least privileged user account with access to the database.
