31 lines
No EOL
2 KiB
Text
31 lines
No EOL
2 KiB
Text
source: http://www.securityfocus.com/bid/15644/info
|
|
|
|
DRZES HMS is prone to multiple SQL injection vulnerabilities. These issues are due to a lack of proper sanitization of user-supplied input before it is used in SQL queries.
|
|
|
|
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.
|
|
|
|
DRZES HMS Version 3.2 and prior are reported to be vulnerable; earlier versions may also be affected.
|
|
|
|
http://www.example.com/customers/domains.php?plan_id=[SQL]
|
|
http://www.example.com/customers/viewinvoice.php?invoiceID=[SQL]
|
|
http://www.example.com/customers/viewplan.php?customerPlanID=[SQL]
|
|
http://www.example.com/customers/referred_plans.php?ref_id=[SQL]
|
|
http://www.example.com/customers/referred_plans.php?sort=id&order=asc&ref_id=[SQL]
|
|
http://www.example.com/customers/viewusage.php?plan_id=[SQL]
|
|
http://www.example.com/customers/listcharges.php?customerPlanID=[SQL]
|
|
http://www.example.com/customers/pop_accounts.php?plan_id=[SQL]
|
|
http://www.example.com/customers/pop_accounts.php?plan_id=35&domain=[SQL]
|
|
http://www.example.com/customers/databases.php?plan_id=[SQL]
|
|
http://www.example.com/customers/databases.php?plan_id=35&domain=[SQL]
|
|
http://www.example.com/customers/ftp_users.php?plan_id=[SQL]
|
|
http://www.example.com/customers/ftp_users.php?plan_id=35&domain=[SQL]
|
|
http://www.example.com/customers/crons.php?plan_id=[SQL]
|
|
http://www.example.com/customers/crons.php?plan_id=35&domain=[SQL]
|
|
http://www.example.com/customers/pass_dirs.php?plan_id=[SQL]
|
|
http://www.example.com/customers/pass_dirs.php?plan_id=35&domain=[SQL]
|
|
http://www.example.com/customers/zone_files.php?plan_id=[SQL]
|
|
http://www.example.com/customers/zone_files.php?plan_id=35&domain=[SQL]
|
|
http://www.example.com/customers/htaccess.php?plan_id=[SQL]
|
|
http://www.example.com/customers/htaccess.php?plan_id=35&domain=[SQL]
|
|
http://www.example.com/customers/software.php?plan_id=[SQL]
|
|
http://www.example.com/customers/software.php?plan_id=35&domain=[SQL] |