vendor:
SG Real Estate Portal
by:
SirGod
7.5
CVSS
HIGH
Blind SQL Injection/Local File Inclusion
94
CWE
Product Name: SG Real Estate Portal
Affected Version From: 2
Affected Version To: 2
Patch Exists: NO
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: Windows, Linux, Mac
2020
SG Real Estate Portal 2.0 Blind SQL Injection/Local File Inclusion
SG Real Estate Portal 2.0 is vulnerable to Blind SQL Injection/Local File Inclusion. An attacker can exploit this vulnerability by sending malicious requests to the server. For example, an attacker can send a malicious request to the server with a Local File parameter containing a relative path to the file they want to access. This can be done by appending %00 to the end of the malicious request. This vulnerability can be exploited by an attacker to gain access to sensitive information stored on the server.
Mitigation:
To mitigate this vulnerability, the application should validate user input and filter out any malicious requests. Additionally, the application should be configured to only allow access to files that are necessary for the application to function.
