Description
SQL injection vulnerability in PHP Labs Top Auction allows remote attackers to execute arbitrary SQL commands via the (1) category and (2) type parameters to viewcat.php, or (3) certain search parameters. NOTE: later a disclosure reported the affected version as 1.0.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Top Auction 1.0 - 'viewcat.php' SQL Injection EDB-3456 · webapps · Mar 11, 2007 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- ADV-2005-2552 vdb-entry
- 3456 exploit
- 15547 vdb-entry
- http://pridels0.blogspot.com/2005/11/top-auction-multiple-sql-vuln.html
- 20070421 Top Auction 1.0 (viewcat.php) Remote Blind SQL Injection // starhack.org mailing-list
- 21106 vdb-entry
- 17687 third-party-advisory
- 21105 vdb-entry
- 20070421 Re: Top Auction 1.0 (viewcat.php) Remote Blind SQL Injection // starhack.org mailing-list