Advanced Medal System SQL Injection

vendor:

psilo

by:

Life Wasted and Caspa

7,5

CVSS

HIGH

SQL Injection

CWE

Product Name: psilo

Affected Version From: 1.42

Affected Version To: 1.42

Patch Exists: NO

Related CWE: N/A

CPE: e107:psilo:699

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Linux

2013

Advanced Medal System SQL Injection

This vulnerability allows an attacker to inject arbitrary SQL commands into the 'advmedsys_view.php' script. The vulnerable code is located in lines 17-23 and 232 of the script. An attacker can exploit this vulnerability by crafting a malicious URL and sending it to a victim. The URL should contain the malicious SQL code in the 'e_QUERY' parameter. For example, http://site.com/plugins/advmedsys_view.php?profile.*SQL HERE*

Mitigation:

Input validation should be used to prevent SQL injection attacks. All user-supplied input should be validated and filtered before being used in SQL queries.

Source

Exploit-DB raw data:

# Exploit Title: Advanced Medal System SQL Injection
# Google Dork: inurl:advmedsys_view.php
# Date: 6/18/13
# Exploit Author: Life Wasted and Caspa
# Vendor Homepage: http://e107.org/e107_plugins/psilo/list.php?mode=plugin&id=699
# Software Link: http://e107.org/e107_plugins/psilo/psilo.php?download.699
# Version: 1.42
# Tested On: Linux

Vulnerable Code (advmedsys_view.php):
// Lines 17-23
if (e_QUERY) {
        $tmp = explode('.', e_QUERY);
        $action = $tmp[0];
        $sub_action = $tmp[1];
        $id = $tmp[2];
        unset($tmp);
}
// Line 232
$sql->db_Select("advmedsys_awarded", "*", "WHERE awarded_user_id = $sub_action","");

Example URL: http://site.com/plugins/advmedsys_view.php?profile.*SQL HERE*