OSVDB ID: 51160

Title: Vacation Script properties_view.php editid1 Parameter SQL Injection

Info

Disclosure
Dec 30, 2008

Discovery
Unknown

Dates

Exploit
Dec 30, 2008

Solution
Unknown

Description

 Vacation Script contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the properties_view.php script not properly sanitizing user-supplied input to the editid1 parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

Classification

 Location: Remote / Network Access
Attack Type: Information Disclosure, Input Manipulation
Impact: Loss of Confidentiality, Loss of Integrity
Solution: Solution Unknown
Exploit: Exploit Public
Disclosure: Uncoordinated Disclosure
OSVDB: Web Related

Solution

Products

Unknown or Incomplete

References

Credit

Unknown or Incomplete


Direct URL: http://osvdb.org/51160