DapperDesk 3.0.x "page" SQL inj.

DapperDesk "page" SQL inj.
Vuln. dicovered by : r0t
Date: 25 nov. 2005
Vendor:http://www.dapperdesk.com/
affected vesion: 3.0.1 and prior


Vuln. Description:
Input passed to the "page" parameter in "news.php" isn't properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

example:
/news.php?page=[SQL]

Solution:

Edit the source code to ensure that input is properly sanitised.