OSVDB ID: 58293 Title: BPowerHouse BPStudents students.php test Parameter SQL Injection |
Info |
|
|
Dates |
||||
|
|
Description |
BPowerHouse BPStudents contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'students.php' script, when 'page' is set to 'preview', not properly sanitizing user-supplied input to the 'test' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database. |
Classification |
Location:
Remote / Network Access
Attack Type: Information Disclosure, Input Manipulation Impact: Loss of Confidentiality, Loss of Integrity Exploit: Exploit Public Disclosure: Uncoordinated Disclosure OSVDB: Web Related |
Solution |
Currently, there are no known upgrades, patches, or workarounds available to correct this issue. |
Products |
Unknown or Incomplete |
References |
|
Credit |
Unknown or Incomplete |