Description
SQL injection vulnerability in Saphp Lesson, possibly saphp Lesson1.1 and saphpLesson2.0, allows remote attackers to execute arbitrary SQL commands via the forumid parameter in (1) showcat.php and (2) add.php.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 2
- saPHP Lesson 2.0 - 'forumid' SQL Injection EDB-1530 · webapps · Feb 25, 2006 · verified
- saPHP Lesson - 'add.php?forumid' SQL Injection EDB-26390 · webapps · Oct 26, 2005 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 17308 third-party-advisory
- 111 third-party-advisory
- 20060412 SaphpLesson 2.0 (forumid) Remote SQL Injection Exploit mailing-list
- saphplesson-multiple-sql-injection(22861) vdb-entry
- 15185 vdb-entry
- 1530 exploit
- 20060711 saphp "add.php" forumid Parameter SQL Injection mailing-list
- 20070704 SQL Injection in saphp "showcat.php" mailing-list
- saphp-add-sql-injection(27746) vdb-entry
- 20290 vdb-entry
- 20051024 SQL saphp Lesson mailing-list
- 20051029 Saphp Lesson mailing-list
- 20289 vdb-entry