OSVDB ID: 48338 Title: K-Rate Premium index.php Multiple Parameter SQL Injection |
Info |
|
|
Dates |
||||
|
|
Description |
K-Rate Premium contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'index.php' script not properly sanitizing user-supplied input to the 'show' parameter (when 'req' is set to 'online') and 'id' and 'image' parameters (when 'act' is set to 'vote'). This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data. |
Classification |
Location:
Remote / Network Access
Attack Type: Information Disclosure, Input Manipulation Impact: Loss of Confidentiality, Loss of Integrity Solution: Solution Unknown Exploit: Exploit Public Disclosure: Third-party Verified, Uncoordinated Disclosure OSVDB: Web Related |
Solution |
OSVDB is not aware of a solution for this vulnerability. |
Products |
|
References |
Credit |
Unknown or Incomplete |