Web Wiz Forums SQL Injection Vulnerability in Member Profile Component

A SQL injection vulnerability has been identified in Web Wiz Forums version 12.01. This issue allows unauthenticated attackers to manipulate database queries by injecting SQL code through the PF parameter. Exploitation involves sending GET requests to the member_profile.asp page with malicious PF values, which can lead to the extraction of sensitive database information.

Impact

Exploitation of this vulnerability allows for unauthorized manipulation of database queries, potentially leading to unauthorized data access or disclosure.

Reproduction

To reproduce this vulnerability, send a GET request to the member_profile.asp page with a crafted PF parameter that includes SQL injection payloads. The injected SQL code can manipulate the database query processing, allowing for data extraction or other malicious database interactions.