Bs General_Classifieds Script Sqli Vulnerability

vendor:

BS Classifieds Ads Software

by:

Sid3^effects aKa HaRi

8,8

CVSS

HIGH

SQL Injection

CWE

Product Name: BS Classifieds Ads Software

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: N/A

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2010

Bs General_Classifieds Script Sqli Vulnerability

BS Classifieds Ads Software allows users to browse and search for classified ads. The listings are detailed with photos, descriptions, ratings, reviews, features, contact information and driving directions linked to MapQuest. Users can also open an account and save their favorite ads to an online notebook. Users can also post their ads. After the completion of registration, users are able to select and buy advertising packages depending on the length of time they would like their listings to be displayed. Payment are done through PayPal and 2Checkout. The user will will be informed about his account statistics by emails - 10 days before his account's expiration, 5 days, 1 day. 24 hours after his account expiration date, all his listings and his account will be deleted automatically. An attacker can exploit this vulnerability by injecting malicious SQL queries into the vulnerable parameters of the application.

Mitigation:

Developers should ensure that user-supplied input is properly sanitized and validated before being used in SQL queries. Additionally, developers should use parameterized queries to prevent SQL injection attacks.

Source

Exploit-DB raw data:

1               ##########################################             1
0               I'm Sid3^effects member from Inj3ct0r Team             1
1               ##########################################             0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

Name :  Bs General_Classifieds Script Sqli Vulnerability
Date : july 5,2010
Critical Level 	: HIGH
vendor URL :http://www.brotherscripts.com/
Price:$24.95
Author : Sid3^effects aKa HaRi <shell_c99[at]yahoo.com>
special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,MaYur,MA1201,KeDar,Sonic,gunslinger_
greetz to :www.topsecure.net ,All ICW members and my friends :) luv y0 guyz 
#######################################################################################################
Description : 
BS Classifieds Ads Software allows users to browse and search for classified ads. The listings are detailed with photos, descriptions, ratings, reviews, features, contact information and driving directions linked to MapQuest. Users can also open an account and save their favorite ads to an online notebook.
Users can also post their ads. After the completion of registration, users are able to select and buy advertising packages depending on the length of time they would like their listings to be displayed. Payment are done through PayPal and 2Checkout. The user will will be informed about his account statistics by emails - 10 days before his account's expiration, 5 days, 1 day. 24 hours after his account expiration date, all his listings and his account will be deleted automatically. 
#######################################################################################################
Xploit :SQli Vulnerability

DEMO URL 1:http://server/General_Classifieds/search.php?c=[sqli]

DEMO URL 2:hhttp://server/General_Classifieds/browse.php?pcat=[sqli]

###############################################################################################################
# 0day no more 
# Sid3^effects