Description
Multiple SQL injection vulnerabilities in phpx 3.5.15 allow remote attackers to execute arbitrary SQL commands via the (1) image_id or (2) cat_id parameter to (a) gallery.php; the (3) news_id parameter to (b) news.php or (c) print.php; (4) the news_cat_id parameter to news.php; the (5) cat_id, (6) topic_id, or (7) post_id parameter to (d) forums.php; or (8) the user_id parameter to (e) users.php.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 5
- PHPX 3.5.15/3.5.16 - 'print.php' SQL Injection EDB-29756 · webapps · Mar 19, 2007 · verified
- PHPX 3.5.15/3.5.16 - 'forums.php' SQL Injection EDB-29757 · webapps · Mar 19, 2007 · verified
- PHPX 3.5.15/3.5.16 - 'users.php' SQL Injection EDB-29758 · webapps · Mar 19, 2007 · verified
- PHPX 3.5.15/3.5.16 - 'news.php' SQL Injection EDB-29759 · webapps · Mar 19, 2007 · verified
- PHPX 3.5.15/3.5.16 - 'gallery.php' SQL Injection EDB-29760 · webapps · Mar 19, 2007 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 20070319 phpx 3.5.15 multiples vulnerabilities mailing-list
- 34418 vdb-entry
- 34417 vdb-entry
- 2457 third-party-advisory
- 34414 vdb-entry
- 23033 vdb-entry
- ADV-2007-1087 vdb-entry
- 24565 third-party-advisory
- 34415 vdb-entry
- 34416 vdb-entry
- phpx-multiple-sql-injection(33155) vdb-entry