vBSupport 2.0.0 Integrated Ticket System - 'vBSupport.php' SQL Injection

Author: rUnViRuS
type: webapps
platform: php
port: 
date_added: 2007-06-09 
date_updated: 2013-12-10 
verified: 1 
codes: CVE-2007-3196;OSVDB-37331 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/24397/info

vBSupport is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

An attacker can exploit this issue by manipulating the SQL query logic to carry out unauthorized actions on the underlying database.

http://www.example.com/4/vBSupport.php?do=showticket&ticketid=[SQL]