Ulisse's Scripts 2.6.1 ladder.php SQL Injection Vulnerability

=============================================================
Ulisse's Scripts 2.6.1 ladder.php SQL Injection Vulnerability
=============================================================


# Tested on: Windows Vista Home Premium and Linux 2.6.28.1 (Backtrack 3)
------------------------------
> Ulisse's Scripts 2.6.1 ladder.php SQL Injection Vulnerability
> Author: Sora
> Google Dork: "In your dreams, script kiddies."
 
# VULNERABILITY DESCRIPTION:
Type: SQL Injection
Level: 4/5 (CRITICAL)
 
Sora has advised that Ulisse's ladder.php file from Ulisse's Scripts 2.6.1
suffers a remote SQL injection vulnerability in the parameter 'gid'. The database inputs
are not properly sanitized.
 
# VULNERABILITY SOLUTION:
Sanitize the unsanitized database inputs in the file ladder.php.
 
# Proof of Concept: http://server/ulisse/ladder.php?gid=1'



#  0day.today [2018-03-13]  #