cve/2015/CVE-2015-1364.md

CVE-2015-1364

Description

SQL injection vulnerability in the getProfile function in system/profile.functions.php in Free Reprintables ArticleFR 3.0.5 allows remote attackers to execute arbitrary SQL commands via the username parameter to register/.

POC

Reference

• http://seclists.org/fulldisclosure/2015/Jan/81
• http://www.exploit-db.com/exploits/35857

Github

• https://github.com/ARPSyndicate/cvemon