vendor:
Links Directory
by:
t0pP8uZz & xprog
7.5
CVSS
HIGH
SQL Injection
89
CWE
Product Name: Links Directory
Affected Version From: 1.1
Affected Version To: 1.1
Patch Exists: NO
Related CWE: N/A
CPE: a:links_directory:links_directory:1.1
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2008
Links Directory 1.1 SQL Injection Vulnerbilitys
Links directorys is vulnerable to a insecure sql query. An attacker can use a malicious URL to inject a SQL query into the vulnerable application. The URL contains a UNION statement that allows the attacker to load a local file on the vulnerable server. The hex inside the load_file() function is '/etc/passwd' in plaintext, however, some permissions are needed to use this function. The admin password is in the config.php file, and if the attacker can find the complete path, they can use load file to view the contents of the file and view the admin password.
Mitigation:
Ensure that user input is properly sanitized and validated before being used in a SQL query.
