Games Site Script, MySQL Injection Vulnerabilities

vendor:

Games Site Script

by:

3spi0n

8,8

CVSS

HIGH

MySQL Injection

CWE

Product Name: Games Site Script

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: No

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2018

Games Site Script, MySQL Injection Vulnerabilities

Games Site Script is prone to a SQL injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. An attacker can exploit this vulnerability to manipulate SQL queries by injecting arbitrary SQL code. This may allow the attacker to access or modify critical data, or even to execute system level commands.

Mitigation:

The best way to mitigate SQL injection attacks is to use parameterized queries (also known as prepared statements).

Source

Exploit-DB raw data:

##################################################################################
       __            _                      _            ____            
      / /___ _____  (_)_____________ ______(_)__  _____ / __ \_________ _
 __  / / __ `/ __ \/ / ___/ ___/ __ `/ ___/ / _ \/ ___// / / / ___/ __ `/
/ /_/ / /_/ / / / / (__  |__  ) /_/ / /  / /  __(__  )/ /_/ / /  / /_/ / 
\____/\__,_/_/ /_/_/____/____/\__,_/_/  /_/\___/____(_)____/_/   \__, /  
                                                                /____/   
##################################################################################																
Games Site Script, MySQL Injection Vulnerabilities
Software Page: http://scriptsgenie.com/index.php?do=catalog&c=scripts&i=games_site_script
Product Page: http://www.hotscripts.com/listing/150-flash-game-script-comes-with-150-games/
Script Demo: http://scriptsgenie.com/demo/GameScript150Games/

Author(Pentester): 3spi0n
On Social: Twitter.Com/eyyamgudeer
Greetz: Grayhats Inc. and Janissaries Platform.
##################################################################################

[~] MySQL Injection on Demo Site (/index.php?act=play&id=)

>>> http://server/index.php?act=play&id=122' (MySQLi Found)