| शीर्षक | Taokeyun Taokeyun ≤1.0.5 SQL Injection |
|---|
| विवरण | The Taokeyun software, version ≤2.1.5, contains a SQL Injection vulnerability in the 'User.php' file within the 'application/index/controller/m' directory. Specifically, the issue resides in the 'login' function where user input is directly incorporated into a SQL query without proper sanitization. This allows an attacker to manipulate the query structure, potentially leading to unauthorized access, data leakage, or even control over the database. The vulnerability can be confirmed by sending a crafted POST request to the login endpoint, causing the server to sleep for a specified duration, indicating successful SQL command execution. |
|---|
| स्रोत | ⚠️ https://note.zhaoj.in/share/Np0ZdyKEnVOV |
|---|
| उपयोगकर्ता | glzjin (UID 59815) |
|---|
| सबमिशन | 11/01/2024 08:03 AM (3 साल पहले) |
|---|
| संयम | 12/01/2024 12:11 PM (1 day later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 250584 [Taokeyun तक 1.0.5 HTTP POST Request User.php login username SQL इंजेक्शन] |
|---|
| अंक | 20 |
|---|