PHPads 2.0 allows unauthorized access to database info

Summary

An attacker can view sensitive information about the database by exploiting a security weakness in the PHPads 2.0 system. This could potentially lead to unauthorized access to the database. PHPads users should update the software to a fixed version to prevent this risk.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
blondish	phpads	2.0	–

Original title

PHPads 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the bannerID parameter in click.php3. A...

Original description

PHPads 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the bannerID parameter in click.php3. Attackers can submit crafted bannerID values using SQL comment syntax and functions like extractvalue to extract sensitive database information such as the current database name.

nvd CVSS3.1 7.1

nvd CVSS4.0 7.1

Vulnerability type

CWE-89 SQL Injection