All Enthusiast ReviewPost PHP Pro 2.5 - showcat.php SQL Injection

2004-02-04T00:00:00
ID EXPLOITPACK:F99A3D4E811BDB737A65714C303ED5DB
Type exploitpack
Reporter G00db0y
Modified 2004-02-04T00:00:00

Description

All Enthusiast ReviewPost PHP Pro 2.5 - showcat.php SQL Injection

                                        
                                            source: https://www.securityfocus.com/bid/9574/info
 
It has been reported that ReviewPost PHP Pro may be prone to multiple SQL injection vulnerabilities that may allow an attacker to influence SQL query logic. This issue could be exploited to disclose sensitive information that may be used to gain unauthorized access. An attacker may pass malicious data via the 'product' parameter of 'showproduct.php' script and the 'cat' parameter of 'showcat.php' script.
 
Although unconfirmed, ReviewPost PHP Pro 2.5.1 and prior may be prone to these issues.

http://www.example.com/directory/showcat.php?cat=[query]