kiCode111 like-girl SQL Injection Vulnerability in ipAddPost.php Admin File
Vulnerability
A critical SQL injection vulnerability has been identified in kiCode111 like-girl version 5.2.0. The issue arises in the admin file ipAddPost.php, where the argument bz/ipdz can be manipulated to inject SQL commands. This vulnerability can be exploited remotely, but requires authentication to access the vulnerable functionality.
Impact
Exploitation of this vulnerability allows for SQL injection, where an attacker can interfere with the application's database queries. This could lead to unauthorized data access, data manipulation, or in some cases, executing administrative operations on the database.
Reproduction
To reproduce this vulnerability, log into the application as an admin. Once authenticated, send a POST request to /admin/ipAddPost.php with the bz parameter set to a crafted value that exploits the SQL injection vulnerability. The injected SQL can be verified using a tool like sqlmap.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.