Secunia Advisory: SA11187
Release Date: 2004-03-23

Critical: Moderately critical
Impact: Exposure of sensitive information
Exposure of system information
Manipulation of data
Where: From remote

Software: Invision Power Top Site List 1.x


Description:
JeiAr has reported a vulnerability in Invision Power Top Site List, allowing malicious people to conduct SQL injection attacks.

The problem is that input passed to the "id" parameter in the "comments" action in "index.php" isn't properly verified before it is used in an SQL query. This can be exploited to manipulate SQL queries and potentially extract sensitive data.

The vulnerability has been reported in version 1.1 RC2 and prior.


Solution:
Edit the source code to ensure that input is properly verified before it is used in SQL queries.


Provided and/or discovered by:
JeiAr of the GulfTech Security Research Team.


Original Advisory:
http://www.gulftech.org/03212004.php

Source: Secunia

OS/2-eCS-ArcaOS General News

More in General  

OS/2-eCS-ArcaOS Software News

More in Software  

Latest Forum Posts

WarpStock and OS/2-eCS-ArcaOS Event News

More in Events  

Site News

More in Site News