Fanli2012 Native-PHP-CMS SQL Injection Vulnerability in product_list.php

A critical SQL injection vulnerability has been identified in Fanli2012 native-php-cms version 1.0. The issue resides in the product_list.php file, where the 'cat' parameter is not properly sanitized, allowing attackers to inject malicious SQL commands. This vulnerability can be exploited remotely.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker can manipulate database queries. This could lead to unauthorized data access, data manipulation, or in some cases, executing administrative operations on the database.

Reproduction

To reproduce this vulnerability, send a request to product_list.php with the 'cat' parameter. Include a crafted value that exploits the lack of input filtering, such as an SQL injection payload that, for example, uses the 'extractvalue' function to retrieve database information.