Simple Customer 1.2 Remort (Auth bypass) SQL Injection Vulnerability

vendor:

Simple Customer

by:

d3b4g

8.5

CVSS

HIGH

SQL Injection

CWE

Product Name: Simple Customer

Affected Version From: 1.2

Affected Version To: 1.2

Patch Exists: NO

Related CWE: N/A

CPE: a:simple_customer:simple_customer:1.2

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

Simple Customer 1.2 Remort (Auth bypass) SQL Injection Vulnerability

A vulnerability in Simple Customer 1.2 allows an attacker to bypass authentication by entering any email address in the email field and entering ' or ' 1=1 in the password field.

Mitigation:

Ensure that user input is properly sanitized and validated before being used in SQL queries.

Source

Exploit-DB raw data:

###############################################################################################
[-] Simple Customer  1.2 Remort (Auth bypass) SQL Injection Vulnerability
[-] Discovered By : d3b4g        
[-] Greetz : All my freind         
################################################################################################
 Go to www.target.com[path]login.php

 Use following information to bypass login.

 Write any email Address as email address.It must to be in email format like somethin@something.com

 For exapmple letmein@inbox.com

 For password use ' or ' 1=1

  Live demo [at] http://www.simplecustomer.com/demo/login.php
--------------------------------------------
--------------------------------------------

# milw0rm.com [2008-11-17]