Million Pixel Ad Script "id_cat" SQL Injection
Report ID:
SA31626
Source:
Secunia
Date of Discovery:
27.08.2008
Criticality:
Moderate
Affects:
Million Pixel Ad Script
Compromise From:
From remote
Compromise Type:
Manipulation of data
Summary
A vulnerability has been reported in Million Pixel Ad Script (Million Pixel Script), which can be exploited by malicious people to conduct SQL injection attacks.
Detailed Description
A vulnerability has been reported in Million Pixel Ad Script (Million Pixel Script), which can be exploited by malicious people to conduct SQL injection attacks.
Input passed to the "id_cat" parameter in tops_top.php is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
Solution
Edit the source code to ensure that input is properly sanitised.