Release Date: 2004-02-04
Critical: Moderately critical
Impact: Exposure of sensitive information, Exposure of system information, Manipulation of data
Where: From remote
Software: ReviewPost PHP Pro
Description:
G00db0y has reported a vulnerability in ReviewPost PHP Pro, allowing malicious people to view or manipulate data.
The problem is that input passed to the "product" and "cat" parameters in "showproduct.php" and "showcat.php" isn't properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries via SQL injection attacks.
Solution:
A patch is reportedly available.
http://www.photopost.com/members...thread.php?s=&threadid=98098
Provided and/or discovered by:
G00db0y, Zone-h Security Labs.
Original Advisory:
http://www.zone-h.org/en/advisories/read/id=3864/
Source: Secunia