All in One Video Downloader 1.2 - SQL Injection

vendor:

All in One Video Downloader

by:

Deyaa Muhammad

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: All in One Video Downloader

Affected Version From: 1.2

Affected Version To: 1.2

Patch Exists: NO

Related CWE: N/A

CPE: a:niche_office:all_in_one_video_downloader

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: WIN7_x68/cloudflare

2019

All in One Video Downloader 1.2 – SQL Injection

All in One Video Downloader 1.2 is vulnerable to SQL Injection. An attacker can exploit this vulnerability to gain access to sensitive information such as user credentials, database name, and version. This vulnerability can be exploited by sending a maliciously crafted SQL query to the vulnerable parameter 'id' in the 'view=page-edit' page. The attacker can use the UNION SELECT statement to retrieve the sensitive information from the database.

Mitigation:

Input validation should be used to prevent SQL injection attacks. All user-supplied input should be validated and filtered before being used in SQL queries.

Source

Exploit-DB raw data:

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="utf-8">
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <meta name="robots" content="noindex, nofollow">
    <title>502 Hosting Server Connect Timeout | Sucuri Website Firewall</title>
    <!--
        Base origin-error page (502/504). lualibs/error_pages.lua fills the double-brace placeholders
        per $whitelabel at request time; init.lua substitutes the server id at load. Keep it
        self-contained: no external stylesheet, script, font, CSS import or remote image
        (tests/rules/71-error-pages-self-contained.sh).
    -->
    <style>
        :root {
            --accent: #3b7a26;
        }

        * {
            box-sizing: border-box;
        }

        html {
            -webkit-text-size-adjust: 100%;
        }

        body {
            margin: 0;
            background: #f4f5f7;
            color: #1d2330;
            font: 16px/1.55 -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif;
        }

        a {
            color: var(--accent);
        }

        p {
            margin: 0 0 10px;
        }

        .wrap {
            max-width: 760px;
            margin: 0 auto;
            padding: 32px 16px 48px;
        }

        .product {
            margin: 0 0 20px;
            font-size: 14px;
            font-weight: 600;
            letter-spacing: .02em;
            color: var(--accent);
        }

        .card {
            padding: 28px 24px;
            background: #fff;
            border: 1px solid #e1e4ea;
            border-radius: 10px;
        }

        h1 {
            margin: 0 0 6px;
            font-size: 26px;
            line-height: 1.25;
        }

        h2 {
            margin: 24px 0 8px;
            font-size: 17px;
        }

        .lead {
            margin: 0 0 4px;
            font-size: 18px;
            color: #414a5a;
        }

        .retry {
            margin: 0;
            color: #5b6475;
        }

        /* You -> Firewall -> Hosting diagram */
        .flow {
            display: flex;
            align-items: flex-start;
            justify-content: space-between;
            gap: 8px;
            margin: 28px 0;
            padding: 0;
            list-style: none;
        }

        .node {
            flex: 0 0 auto;
            width: 132px;
            text-align: center;
            font-size: 14px;
            font-weight: 600;
        }

        .icon {
            position: relative;
            display: inline-flex;
            align-items: center;
            justify-content: center;
            width: 64px;
            height: 64px;
            margin-bottom: 6px;
            border-radius: 50%;
        }

        .icon svg {
            width: 32px;
            height: 32px;
            fill: none;
            stroke: currentColor;
            stroke-width: 1.8;
            stroke-linecap: round;
            stroke-linejoin: round;
        }

        .ok-node .icon {
            background: #e7f4ea;
            color: #2f7d3c;
        }

        .fail-node,
        .fail-node .icon {
            color: #c0362c;
        }

        .fail-node .icon {
            background: #fdebea;
        }

        .badge {
            position: absolute;
            right: -2px;
            bottom: -2px;
            width: 22px;
            height: 22px;
            border-radius: 50%;
            color: #fff;
            font-size: 13px;
            line-height: 22px;
        }

        .badge.ok {
            background: #2f7d3c;
        }

        .badge.fail {
            background: #c0362c;
        }

        /* Connector, vertically centred on the 64px icons */
        .link {
            flex: 1 1 auto;
            height: 2px;
            margin-top: 31px;
            background: #c9ced8;
        }

        .link.broken {
            background: repeating-linear-gradient(90deg, #c0362c 0 6px, transparent 6px 11px);
        }

        dl {
            display: grid;
            grid-template-columns: max-content 1fr;
            gap: 4px 16px;
            margin: 0;
            padding: 14px 16px;
            background: #f7f8fa;
            border-radius: 8px;
            font-size: 15px;
        }

        dt {
            color: #5b6475;
        }

        dd {
            margin: 0;
            font-weight: 600;
            overflow-wrap: anywhere;
        }

        ul.causes {
            margin: 0;
            padding-left: 20px;
        }

        footer {
            margin-top: 20px;
            font-size: 13px;
            color: #6b7383;
            text-align: center;
        }

        @media (max-width: 520px) {
            .wrap {
                padding: 20px 16px 32px;
            }

            .card {
                padding: 20px 16px;
            }

            h1 {
                font-size: 22px;
            }

            .flow {
                gap: 4px;
            }

            .node {
                flex: 1 1 0;
                width: auto;
                min-width: 0;
                font-size: 12px;
                line-height: 1.3;
            }

            /* Connector, vertically centred on the 52px icons */
            .link {
                flex: 0 0 14px;
                margin-top: 25px;
            }

            .icon {
                width: 52px;
                height: 52px;
            }

            .icon svg {
                width: 26px;
                height: 26px;
            }
        }
    </style>
</head>
<body>
    <main class="wrap">
        <p class="product">Sucuri Website Firewall</p>

        <div class="card">
            <h1>Hosting Server Connect Timeout</h1>
            <p class="lead">HTTP 502 &mdash; Unable to Connect to the Origin Server</p>
            <p class="retry">Please try again in a few minutes.</p>

            <ol class="flow" aria-label="Connection path">
                <li class="node ok-node">
                    <span class="icon">
                        <svg viewBox="0 0 24 24" aria-hidden="true">
                            <circle cx="12" cy="8" r="4"/>
                            <path d="M4 21c0-4.4 3.6-8 8-8s8 3.6 8 8"/>
                        </svg>
                        <span class="badge ok" aria-hidden="true">&#10003;</span>
                    </span><br>
                    You
                </li>
                <li class="link" aria-hidden="true"></li>
                <li class="node ok-node">
                    <span class="icon">
                        <svg viewBox="0 0 24 24" aria-hidden="true">
                            <path d="M12 2 4 5v6c0 5 3.4 9.3 8 11 4.6-1.7 8-6 8-11V5z"/>
                        </svg>
                        <span class="badge ok" aria-hidden="true">&#10003;</span>
                    </span><br>
                    Sucuri Firewall
                </li>
                <li class="link broken" aria-hidden="true"></li>
                <li class="node fail-node">
                    <span class="icon">
                        <svg viewBox="0 0 24 24" aria-hidden="true">
                            <rect x="4" y="3" width="16" height="7" rx="1.5"/>
                            <rect x="4" y="14" width="16" height="7" rx="1.5"/>
                            <path d="M8 6.5h.01M8 17.5h.01"/>
                        </svg>
                        <span class="badge fail" aria-hidden="true">&#10005;</span>
                    </span><br>
                    Hosting Timeout
                </li>
            </ol>

            <h2>Error details</h2>
            <dl>
                <dt>Error code</dt>
                <dd>HTTP 502</dd>
                <dt>Error message</dt>
                <dd>Backend or gateway connection timeout.</dd>
                <dt>Server ID</dt>
                <dd>14012</dd>
            </dl>

            <h2>What's going on?</h2>
            <ul class="causes">
                <li>The origin server might be down</li>
                <li>The Sucuri network might be blocked by the origin&#39;s firewall</li>
            </ul>

            <h2>What can I do to fix it?</h2>
            <p>
                If you are just visiting the site, wait a bit and it should be back soon.
                We apologize for the inconvenience.
            </p>
            <p>
                If you own the website, check with your hosting company that your server is up and
                running and that they have <a href="https://docs.sucuri.net/website-firewall/troubleshooting/backend-timeout-message/">our firewall IPs allowlisted</a>.
            </p>
            <p>If the problem persists, open a ticket on our <a href="https://support.sucuri.net">support page</a> and we will help you troubleshoot.</p>
        </div>

        <footer>&copy; Sucuri Inc. All rights reserved. &middot; <a href="https://sucuri.net/privacy/">Privacy Policy</a></footer>
    </main>
</body>
</html>