| 제목 | Virtual Airlines Manager 2.6.2 SQL Injection |
|---|
| 설명 | A SQL Injection vulnerability exists in Virtual Airlines Manager v2.6.2 due to insufficient input validation in multiple GET parameters. This allows an attacker to inject arbitrary SQL queries, potentially leading to unauthorized database access, data exfiltration, and, depending on database permissions, data modification or deletion. The vulnerable endpoints include:
/vam/index.php?page=manual_flight_details&ID=10
/vam/index.php?page=plane_info_public®istry_id=10
/vam/index.php?page=fleet_public&plane_icao=1
By exploiting this vulnerability, an attacker can enumerate database names, extract sensitive information such as user credentials (if stored in plaintext or weakly hashed), and potentially execute administrative operations. |
|---|
| 원천 | ⚠️ https://vam.fidusair.com/vam/index.php?page=manual_flight_details&ID=10 |
|---|
| 사용자 | davimo (UID 79678) |
|---|
| 제출 | 2025. 03. 03. PM 04:24 (2 연령 ago) |
|---|
| 모더레이션 | 2025. 03. 15. PM 09:40 (12 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 299820 [VAM Virtual Airlines Manager 까지 2.6.2 HTTP GET Parameter /vam/index.php ID/registry_id/plane_icao SQL 주입] |
|---|
| 포인트들 | 20 |
|---|