high7.5Public exploit code
CVE-2013-3536
SQL injection vulnerability in the gp_LoadUserFromHash function in functions_hash.php in the Group Pay module 1.5 and earlier for WHMCS allows remote attackers…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- WHMCompleteSolution (WHMCS) Group Pay Plugin 1.5 - 'grouppay.php?hash' SQL Injection2013-04-08 · webapps · php
Impact
SQL injection vulnerability in the gp_LoadUserFromHash function in functions_hash.php in the Group Pay module 1.5 and earlier for WHMCS allows remote attackers to execute arbitrary SQL commands via the hash parameter.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Whmcs | Group Pay | through 1.5 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/121046/WHMCS-Grouppay-1.5-SQL-Injection.html
- http://secunia.com/advisories/52804
- http://www.exploit-db.com/exploits/24934
- http://www.osvdb.org/91980
- http://packetstormsecurity.com/files/121046/WHMCS-Grouppay-1.5-SQL-Injection.html
- http://secunia.com/advisories/52804
- http://www.exploit-db.com/exploits/24934
- http://www.osvdb.org/91980