Description - Multiple SQL Injections in phpNewsManager

SQL Injection found in phpNewsManager script.

Exploit

Available

Solution

Not available - check SkinTech Group website

All user-defined variables are not properly sanitized before being used in SQL queries. This can be used to bypass authentication or make any SQL query by injecting arbitrary SQL code.

Vulnerable scripts:
browse.php
category.php
gallery.php
poll.php
...