Free Advertisment cms (user_info.php) SQL Injection Vulnerability

vendor:

Free Advertisment cms

by:

Ashiyane Digital Security Team

7,5

CVSS

HIGH

SQL Injection

CWE

Product Name: Free Advertisment cms

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: N/A

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2010

Free Advertisment cms (user_info.php) SQL Injection Vulnerability

A SQL injection vulnerability exists in Free Advertisment cms, which allows an attacker to execute arbitrary SQL commands via the user_info.php?user_id= and index.php?catid= parameters.

Mitigation:

Input validation should be used to prevent SQL injection attacks. All user-supplied input should be validated and filtered before being used in an SQL query.

Source

Exploit-DB raw data:

=========================================================
Free Advertisment cms (user_info.php) SQL Injection Vulnerability
=========================================================
##########################################
# Name: Free Advertisment cms (user_info.php) SQL Injection Vulnerability
# Date: 2010-05-11
# vendor: http://www.laserayaneh.com
# Author: Ashiyane Digital Security Team
# Thanks to: khodam :P, Satanic2000,Veron, ... And All Ashiyane Members ...
# Contact: Xrogue_p3rsi4n_hack3r[at]Hotmail[Dot]com
# Home: www.Ashiyane.org
##########################################

[+] Dork: " inurl: user_info.php?user_id= "  Or  " inurl: index.php?catid= "


[+] Vulnerability:

                    www.site.com/[path]/user_info.php?user_id=[SQLi] 
                    www.site.com/[path]/index.php?catid=[SQLi]


##########################################