paFileDB includes/search.php categories Parameter SQL Injection
Medium Nessus Network Monitor Plugin ID 4136
SynopsisThe remote web server contains a PHP script that is prone to SQL a injection attack.
DescriptionThe version of paFileDB installed on the remote host fails to sanitize user-supplied input to the 'categories' parameter before using it in the 'includes/search.php' script to make database queries. An unauthenticated attacker can exploit this issue to manipulate database queries, which may lead to disclosure of sensitive information, modification of data or attacks against the underlying database.
SolutionNo solution is known at this time.