Bs Auction Script Sqli Vulnerability

vendor:

Auction Script

by:

Sid3^effects aKa HaRi

8,8

CVSS

HIGH

SQL Injection

CWE

Product Name: Auction Script

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2010

Bs Auction Script Sqli Vulnerability

BrotherScripts Auction Script is vulnerable to SQL Injection. An attacker can inject malicious SQL queries into the 'id' parameter of the 'confirm.php' page. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

Mitigation:

Input validation should be used to prevent SQL injection attacks. All user-supplied input should be validated and filtered before being used in SQL queries.

Source

Exploit-DB raw data:

1               ##########################################             1
0               I'm Sid3^effects member from Inj3ct0r Team             1
1               ##########################################             0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

Name :  Bs Auction Script Sqli Vulnerability
Date : july 5,2010
Critical Level 	: HIGH
vendor URL :http://www.brotherscripts.com/
Price:$24.95
Author : Sid3^effects aKa HaRi <shell_c99[at]yahoo.com>
special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,MaYur,MA1201,KeDar,Sonic,gunslinger_
greetz to :www.topsecure.net ,All ICW members and my friends :) luv y0 guyz 
#######################################################################################################
Description : 
Site design of the demo may not match the product theme you are interested. The demo is just for the demonstration purposes. For the actual design, enlarge the image given above. In addition, many functions are disabled in demo.

Begin your own professional online auction website with BrotherScripts just right now. Our auction software has many functions, well designed and easy customizable templates for the lowest possible price. The Quality and good Support guaranteed!


#######################################################################################################
Xploit :BSQli Vulnerability

DEMO URL :http://server/Auction_Software/confirm.php?id=[sqli]

###############################################################################################################
# 0day no more 
# Sid3^effects