header-logo
Suggest Exploit
vendor:
AV Arcade Free Edition
by:
DaOne
7,5
CVSS
HIGH
Blind SQL Injection
89
CWE
Product Name: AV Arcade Free Edition
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: N/A
Related CWE: N/A
CPE: N/A
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2012

AV Arcade Free Edition Blind SQL Injection

AV Arcade Free Edition is vulnerable to Blind SQL Injection. An attacker can exploit this vulnerability by sending malicious SQL queries to the vulnerable parameter 'id' in the 'add_rating.php' page. This can allow the attacker to gain access to the database and potentially execute arbitrary code.

Mitigation:

Input validation should be used to prevent SQL injection attacks. All user-supplied input should be validated and filtered before being used in SQL queries.
Source

Exploit-DB raw data:

##########################################
[~] Exploit Title: AV Arcade Free Edition Blind SQL Injection
[~] Date: 31/08/2012
[~] Author: DaOne (@LibyanCA)
[~] Software Link: http://www.avscripts.net/avarcade/freearcadescript/
[~] Google Dork: intext:Powered by AV Arcade Free Edition"
##########################################

# Exploit-DB Note: Must be logged in.

[#] [ Exploit ]

http://localhost/content/add_rating.php?id=[Blind SQL Injection]


##########################################
[*] thanks to : All LibyanCA Members (^_^)
##########################################

Navigation

Suggest Exploit

Services By CQR