Reply to thread

Message: <blockquote data-quote="Ecko" data-source="post: 452572" data-attributes="member: 24874">That's only true at a very basic level, but doesn't indicate actual injection. Just cause I can do query.php?what=deletegroup&id=1 and it executes doesn't make it an injection. Unless you're able to cause manipulation where your own specific queries get executed (ie - having query.php do an UPDATE query), but doesn't seem like that will happen here.Also, we do not know the stack that is running here or what all is installed that could prevent malicious requests (ModSecurity, suhosin/snuffleupagus, etc). If I had the db structure, I'd set this up on one of my servers and let you attempt to exploit it.</blockquote>