Gekko CMS (SQL Injection) Vulnerability

# [2]-SQL injection # # Vulnerability Description: # SQL injection is a code injection technique that exploits a security vulnerability occurring in the database layer of an #application. The vulnerability is present when user input is either incorrectly filtered for string literal escape characters embedded in SQL #statements or user input is not strongly typed and thereby unexpectedly executed. # # Affected items: # http://127.0.0.1/path/search/?cvx=[SQL Injection] # http://127.0.0.1/path/search/?uid=[SQL Injection] # http://127.0.0.1/path/search/action/search/?cvx=[SQL Injection] # http://127.0.0.1/path/search/action/search/?uid=[SQL Injection] # # Example: -1+ORDER+BY+1-- [You can find the number of columns (Well just incrementing the number until we get an error.)] # # The Risk: # By exploiting this vulnerability, an attacker can inject malicious code in the script and can have access to the database. # # Fix the vulnerability: # To protect against SQL injection, user input must not directly be embedded in SQL statements. Instead, parametrized statements must be used #(preferred), or user input must be carefully escaped or filtered. # ################################################################# #################################################################