| शीर्षक | LyLme lylme_spage 2.1 SQL Injection |
|---|
| विवरण | A time-based blind SQL injection vulnerability exists in the lylme_spage project due to improper handling of the sort parameter in an SQL INSERT statement. The parameter is directly concatenated into the SQL query without sanitization or parameterization. This allows an unauthenticated attacker to inject malicious SQL payloads that can delay server responses based on conditional logic, confirming the vulnerability. A crafted payload using the sleep() function can be used to extract information from the database (e.g., current user), one character at a time. |
|---|
| स्रोत | ⚠️ https://github.com/yanbeiii/Proof-of-Concept/blob/main/lylme-sqli.md |
|---|
| उपयोगकर्ता | yanbei (UID 84800) |
|---|
| सबमिशन | 29/04/2025 05:07 PM (1 वर्ष पहले) |
|---|
| संयम | 10/05/2025 03:56 PM (11 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 308289 [LyLme Spage 2.1 ajax_link.php sort SQL इंजेक्शन] |
|---|
| अंक | 20 |
|---|