Redaxscript is prone to a SQL injection vulnerability.

An unauthenticated attacker might execute arbitrary SQL commands to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Upgrade to Radexscript 2.3.0 or later.

The search_post function in includes/search.php is prone to an SQL injection vulnerability in the search_terms parameter.

Radexscript 2.2.0

Check the version or if no version detected try to perform an SQL injection.

• http://www.exploit-db.com/exploits/36023/
• http://www.itas.vn/news/itas-team-found-out-a-sql-injection-vulnerability-in-redaxscript-2-2-0-cms-75.html

---

Updated on 2015-03-25