Description
OpenBiz Cubi Lite 3.0.8 contains a SQL injection vulnerability in the login form that allows unauthenticated attackers to manipulate database queries through the username parameter. Attackers can submit POST requests to /bin/controller.php with malicious SQL code in the username field to extract sensitive database information or bypass authentication.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Sourceforge | OpenBiz Cubi Lite | v3.0.8 | — |
References
- ExploitDB-45801 exploit
- Official Product Homepage product
- Product Reference product
- VulnCheck Advisory: OpenBiz Cubi Lite 3.0.8 SQL Injection via username Parameter third-party-advisory