Executive brief
Twitter-Clone, a PHP-based social media application, contains a security flaw that allows unauthorized individuals to access its underlying database. By sending specially crafted web requests, an attacker can steal sensitive information such as user credentials, system data, and private account details. This could lead to a total compromise of user accounts and the exposure of all data stored within the application.
Technical details
A SQL injection vulnerability exists in Twitter-Clone version 1.0 and earlier due to improper neutralization of user-supplied input in multiple components. Specifically, the 'name' parameter in search.php, the 'code' parameter in mailactivation.php, and the 'id' parameter in stalkers.php are passed directly into MySQL queries without sanitization. An unauthenticated remote attacker can exploit these endpoints using error-based or union-based SQL injection techniques. Successful exploitation allows for the extraction of arbitrary data from the database, including usernames, password hashes, and system configuration details. No patch is currently documented for this legacy repository.
Affected products
- Fyffe (PHP-Twitter-Clone) Twitter-Clone 1.0 and earlier
Timeline
- 2018-08-23: disclosed: Exploit published on Exploit-DB
- 2026-05-25: advisory: NVD and VulnCheck advisory published