Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
Vanilla Forums Improper Neutralization of Special Elements used in an SQL Command (SQL Injection) Vulnerability - CVE-2018-16410 - Vulnerability Database
Vanilla Forums

Vanilla Forums Improper Neutralization of Special Elements used in an SQL Command (SQL Injection) Vulnerability - CVE-2018-16410

Medium
Reference: CVE-2018-16410
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2018-16410
Title: Vanilla Forums Improper Neutralization of Special Elements used in an SQL Command (SQL Injection) Vulnerability
Overview:

Vanilla before 2.6.1 allows SQL injection via an invitationID array to /profile/deleteInvitation related to applications/dashboard/models/class.invitationmodel.php and applications/dashboard/controllers/class.profilecontroller.php.