Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

paFileDB includes/search.php categories Parameter SQL Injection

Medium

Synopsis

The remote web server contains a PHP script that is prone to SQL a injection attack.

Description

The version of paFileDB installed on the remote host fails to sanitize user-supplied input to the 'categories' parameter before using it in the 'includes/search.php' script to make database queries. An unauthenticated attacker can exploit this issue to manipulate database queries, which may lead to disclosure of sensitive information, modification of data or attacks against the underlying database.

Solution

No solution is known at this time.