Description
QuickDate 1.3.2 contains a SQL injection vulnerability that allows remote attackers to manipulate database queries through the '_located' parameter in the find_matches endpoint. Attackers can inject UNION-based SQL statements to extract database information including user credentials, database name, and system version.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| QuickDate | QuickDate | 1.3.2 | — |
References
- ExploitDB-48022 exploit
- Archived QuickDate Script Webpage product
- VulnCheck Advisory: QuickDate 1.3.2 - SQL Injection third-party-advisory