| शीर्षक | XHCMS login.php page, user parameter has SQL injection |
|---|
| विवरण | A vulnerability classified as critical was found in XHCMS. This affects the section of the file login.php where an operation on the parameter user leads to sql injection
Source code analysis found that the login page directly through the POST parameters received user, password, and did not do any filtering, and then directly executed the UPDATE/DELETE/INSERT statements, we can directly report error injection, here constitutes a sql injection vulnerability.
The next process is to query the user name, if the user name exists, the password obtained from the POST will be md5 hashed, and then compared with the corresponding password in the database.
|
|---|
| स्रोत | ⚠️ https://github.com/wswokao/wswoako.github.io/blob/main/README.md |
|---|
| उपयोगकर्ता | parad0x (UID 42770) |
|---|
| सबमिशन | 13/03/2023 04:12 AM (4 साल पहले) |
|---|
| संयम | 13/03/2023 08:44 AM (5 hours later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 222874 [XHCMS 1.0 POST Parameter login.php user SQL इंजेक्शन] |
|---|
| अंक | 20 |
|---|