|
|
Family: CGI abuses --> Category: attack
MyReview email SQL Injection Vulnerability Vulnerability Scan
Vulnerability Scan Summary
Checks for SQL injection flaw in MyReview
Detailed Explanation for this Vulnerability Test
Synopsis :
The remote web server contains a PHP script that is prone to a SQL
injection attack.
Description :
The remote host is running MyReview, an open-source paper submission
and review web application.
The version of MyReview installed on the remote host fails to properly
sanitize input to the 'email' parameter before using it in the
'GetMember' function in a database query. Regardless of PHP's
'magic_quotes_gpc' and 'register_globals' settings, an unauthenticated
attacker may be able to exploit this issue to uncover sensitive
information such as password hashes, modify data, launch attacks
against the underlying database, etc.
See also :
http://milw0rm.com/exploits/2397
Solution :
Unknown at this time.
Threat Level:
High / CVSS Base Score : 7.0
(AV:R/AC:L/Au:NR/C:P/I:P/A:P/B:N)
Click HERE for more information and discussions on this network vulnerability scan.
|
