vendor:
Link ADS 1 PHP script
by:
Jose Luis Gongora Fernandez
7,5
CVSS
HIGH
Blind SQL Injection
89
CWE
Product Name: Link ADS 1 PHP script
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: N/A
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2009
E-topbiz Link ADS 1 PHP script (linkid) Blind SQL Injection Vulnerability
This vulnerability allows an attacker to inject malicious SQL queries into the vulnerable application. The attacker can use the 'linkid' parameter to inject malicious SQL queries and extract sensitive information from the database. The proof of concept is demonstrated by sending a GET request to the '/out.php' page with the 'linkid' parameter set to '50+and+1=1' (true) and '50+and+1=2' (false). The exploit is demonstrated by sending a GET request to the '/out.php' page with the 'linkid' parameter set to '50+and+substring(@@version,1,1)=4' and '50+and+substring(@@version,1,1)=5'.
Mitigation:
The application should use parameterized queries to prevent SQL injection attacks. Input validation should also be used to prevent malicious input from being passed to the application.
