Release Date: 2004-03-23
Critical: Moderately critical
Impact: Exposure of sensitive information
Exposure of system information
Manipulation of data
Where: From remote
Software: Invision Power Top Site List 1.x
Description:
JeiAr has reported a vulnerability in Invision Power Top Site List, allowing malicious people to conduct SQL injection attacks.
The problem is that input passed to the "id" parameter in the "comments" action in "index.php" isn't properly verified before it is used in an SQL query. This can be exploited to manipulate SQL queries and potentially extract sensitive data.
The vulnerability has been reported in version 1.1 RC2 and prior.
Solution:
Edit the source code to ensure that input is properly verified before it is used in SQL queries.
Provided and/or discovered by:
JeiAr of the GulfTech Security Research Team.
Original Advisory:
http://www.gulftech.org/03212004.php
Source: Secunia