Lucene search
wheatblog-rfi.txt
SQL Injection and Remote File Inclusion vulnerabilities in WheatBlo
Show more
`Found by E.Minaev ([email protected])
ITDefence.ru
1) SQL Injection in login function. With help of this injection is possible to make per-symbol brute of tables names of blog's database (magic_quotes_gpc should be tured off).
------------------------------------------
"$sql = "select * from $tblUsers where login = '$login'";
if ( $login != $row['login'] ) $valid_user = 0;
if ( $password != $row['password'] ) $valid_user = 0;"
------------------------------------------
2) Remote File Inclusion (RFI)
/includes/sessions.php?wb_class_dir=shell?
`
Transform Your Security Services
Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.
Book a live demo01 Jul 2007 00:00Current
7.4High risk
Vulners AI Score7.4