Description
microASP Portal+ CMS contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code into the explode_tree parameter. Attackers can send crafted requests to pagina.phtml with SQL injection payloads using extractvalue and concat functions to extract sensitive database information like the current database name.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Microasp | microASP (Portal+) CMS | — | — |
References
- ExploitDB-46799 exploit
- Official Product Homepage product
- VulnCheck Advisory: microASP Portal+ CMS SQL Injection via pagina.phtml third-party-advisory