VAM Virtual Airlines Manager SQL Injection Vulnerability in HTTP GET Parameter Handler

A critical SQL injection vulnerability has been identified in VAM Virtual Airlines Manager versions prior to 2.6.2. The issue arises in an unknown function of the file /vam/index.php, specifically within the HTTP GET Parameter Handler. The vulnerability is triggered by manipulating the ID, registry_id, or plane_icao parameters, allowing for remote exploitation. While the primary parameters have been identified, other parameters may also be affected.

Impact

Exploitation of this vulnerability allows for SQL injection, which could be used to manipulate database queries, potentially leading to unauthorized data access or modification.