Description
SQL injection vulnerability in index.php in Phpclanwebsite (aka PCW) 1.23.1 allows remote attackers to execute arbitrary SQL commands via the (1) par parameter in the post function on the forum page and possibly the (2) poll_id parameter on the poll page. NOTE: the poll_id vector can also allow resultant cross-site scripting (XSS) from an unquoted error message for invalid SQL syntax.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Phpclanwebsite 1.23.1 - SQL Injection EDB-1453 · webapps · Jan 25, 2006 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 20060125 HYSA-2006-002 Phpclanwebsite 1.23.1 Multiple Vulnerabilities mailing-list
- 16391 vdb-entry
- http://www.h4cky0u.org/advisories/HYSA-2006-002-phpclan.txt
- 22722 vdb-entry
- 22720 vdb-entry
- ADV-2006-0342 vdb-entry
- 18597 third-party-advisory
- phpclanwebsite-index-sql-injection(24355) vdb-entry