Ravens PHP Scripts

Youtube Script *id* SQL Injection Vulnerability
Date: Tuesday, July 03, 2007 @ 14:16:07 PDT
Topic: Security


SECUNIA ADVISORY ID: SA25922

VERIFY ADVISORY: http://secunia.com/advisories/25922/

CRITICAL: Moderately critical

IMPACT: Manipulation of data

WHERE: >From remote

SOFTWARE: Youtube Script - http://secunia.com/product/14684/

DESCRIPTION: t0pP8uZz & xprog has reported a vulnerability in Youtube Script, which can be exploited by malicious people to conduct SQL injection attacks.



Input passed to the "id" parameter in msg.php is not properly sanitised before being used in an SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

SOLUTION: Edit the source code to ensure that input is properly sanitised.

PROVIDED AND/OR DISCOVERED BY: t0pP8uZz & xprog

ORIGINAL ADVISORY: http://milw0rm.com/exploits/4136






This article comes from Ravens PHP Scripts
http://www.ravenphpscripts.com

The URL for this story is:
http://www.ravenphpscripts.com/modules.php?name=News&file=article&sid=2993