PHPads SQL Injection Vulnerability in click.php3

A SQL injection vulnerability has been identified in PHPads version 2.0. This issue allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the bannerID parameter in click.php3. Exploitation of this vulnerability could lead to the extraction of sensitive database information, such as the current database name.

Impact

Successful exploitation allows for arbitrary SQL execution, potentially leading to unauthorized data access or manipulation.

Reproduction

To reproduce this vulnerability, send a request to click.php3 with a crafted bannerID parameter that includes SQL injection payloads. The payload can use SQL comment syntax and functions like extractvalue to extract database information.