SQL injection

Status: Inactive

Brought to you by: willuhn

#36 SQL injection

Milestone: v_1.2.x

Status: open

Owner: nobody

Labels: Security issues (2)

Priority: 5

Updated: 2006-04-19

Created: 2006-04-19

Creator: Anonymous

Private: No

SQL injection exists in PMtool in parameter 'order'.

It reveals the table name and column name.

Credit: Pratiksha Doshi, Security Anaylst, NII Consulting

Best Regards
Pratiksha Doshi