icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons_061

paFileDB includes/search.php categories Parameter SQL Injection

Medium

Synopsis

The remote web server contains a PHP script that is prone to SQL a injection attack.

Description

The version of paFileDB installed on the remote host fails to sanitize user-supplied input to the 'categories' parameter before using it in the 'includes/search.php' script to make database queries. An unauthenticated attacker can exploit this issue to manipulate database queries, which may lead to disclosure of sensitive information, modification of data or attacks against the underlying database.

Solution

No solution is known at this time.