Exploit eTicket 1.5.5.2 - 'admin.php' Multiple SQL Injections

[Exploiter]

EDB-ID

30997

Проверка EDB

1. Пройдено

Автор

L4TERAL

Тип уязвимости

WEBAPPS

Платформа

PHP

CVE

cve-2008-0267

Дата публикации

2008-01-07

source: https://www.securityfocus.com/bid/27173/info
   
eTicket is prone to multiple input-validation vulnerabilities because the application fails to properly sanitize user-supplied input. These vulnerabilities include multiple SQL-injection issues, a cross-site scripting issue, and an authentication-bypass issue.
   
A successful exploit could allow an attacker to compromise the application, access or modify data, exploit vulnerabilities in the underlying database, or execute arbitrary script code in the browser of an unsuspecting user.
   
These issues affect eTicket 1.5.5.2; other versions may also be affected.

http://www.example.com/eTicket/admin.php?a=headers&msg=SQL'