Bs Scripts_Directory Sqli/Auth Bypass Vulnerability

vendor:

BS Scripts Directory

by:

Sid3^effects aKa HaRi

9,3

CVSS

HIGH

SQL Injection and Authentication Bypass

89,287

CWE

Product Name: BS Scripts Directory

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2010

Bs Scripts_Directory Sqli/Auth Bypass Vulnerability

BS Scripts Directory software allows users to browse and search for scripts. The listings are fully detailed with photos, features, descriptions, ratings, reviews, and seller's information. Members can also post their scripts in the categories added by administrator. After the registration user is able to select and buy a advertising package depending on the length of time he/she would like their listings to be displayed on the website. Payment can be made through PayPal or 2Checkout. The user will be informed automatically about his statistics - 10 days before the expiration of his account , 5 days, 1 day. 24 hours after his account expiration date, all his listings and his account will be deleted automatically from the system. The SQL Injection vulnerability can be exploited by appending a malicious SQL query to the 's' parameter in the 'search.php' script. The Authentication Bypass vulnerability can be exploited by using ' or 1=1 or ''=' in both username and password fields.

Mitigation:

Input validation should be used to prevent SQL Injection attacks. Authentication should be properly implemented to prevent Authentication Bypass attacks.

Source

Exploit-DB raw data:

1               ##########################################             1
0               I'm Sid3^effects member from Inj3ct0r Team             1
1               ##########################################             0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

Name : Bs Scripts_Directory Sqli/Auth Bypass Vulnerability
Date : july 5,2010
Critical Level 	: HIGH
vendor URL :http://www.brotherscripts.com/
Price:$24.95
Author : Sid3^effects aKa HaRi <shell_c99[at]yahoo.com>
special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,MaYur,MA1201,KeDar,Sonic,gunslinger_
greetz to :www.topsecure.net ,All ICW members and my friends :) luv y0 guyz 
#######################################################################################################
Description : 
BS Scripts Directory software allows users to browse and search for scripts. The listings are fully detailed with photos, features, descriptions, ratings, reviews, and seller's information.

Members can also post their scripts in the categories added by administrator. After the registration user is able to select and buy a advertising package depending on the length of time he/she would like their listings to be displayed on the website. Payment can be made through PayPal or 2Checkout. The user will be informed automatically about his statistics - 10 days before the expiration of his account , 5 days, 1 day. 24 hours after his account expiration date, all his listings and his account will be deleted automatically from the system. 
#######################################################################################################
Xploit :SQli Vulnerability

DEMO URL :http://server/Scripts_Directory/search.php?s=[sqli]

###############################################################################################################
Xploit: Auth Bypass

use  ' or 1=1 or ''='  in both username and password :D 
###############################################################################################################
# 0day no more 
# Sid3^effects