SQL Injection vulnerability in32ns KLive v.2019-1-19 and before allows a remote attacker to obtain sensitive information via a crafted script to the web/user.php component.
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
| Link | Tags |
|---|---|
| https://github.com/Chiaki2333/vulnerability/blob/main/32ns-KLive-SQL-user.php.md | exploit |
| https://github.com/32ns/KLive | product |
| https://gist.github.com/Chiaki2333/f09b47a39e175932d8a2360e439194d5 | third party advisory |