The host is running Devana and is prone to SQL injection vulnerability.

Successful exploitation will allow attacker to cause SQL Injection attack and gain sensitive information. Impact Level: Application

Upgrade to Devena-v2_beta-1 or later, For updates refer to http://sourceforge.net/projects/devana

The flaw is caused by improper validation of user-supplied input via the 'id' parameter in 'profile_view.php' which allows attacker to manipulate SQL queries by injecting arbitrary SQL code.

Devana Version 1.6.6 and prior.

• http://packetstormsecurity.org/1003-exploits/devana-sql.txt
• http://secunia.com/advisories/39121
• http://www.exploit-db.com/exploits/11922

---

Updated on 2015-03-25