SQL-Injection in pointdata2.php

[crocodile-bit]

In the pointdata2.php file, you can use the GET parameter "id" to execute your own SQL statements. An example exploit is:

/twmap3/data/ajaxCRUD/pointdata2.php?id=1%20OR%201=1

The problem can be solved by first escaping the parameter (line 12):
$id = mysqli_real_escape_string ($mysqliConn, $_GET ['id']);

In addition, the parameter must then be put into a string environment in the query (line 22):
$sql. = "where id = '$id'";

After that, the $id parameter can no longer be misused for SQL injection attacks.

The vulnerability also exists in the ajaxCRUD_old directory