Hotel / Resort Site Script with OnLine Reservation System SQLi Vulnerable

vendor:

Hotel / Resort Site Script with OnLine Reservation System

by:

L0rd CrusAd3r

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: Hotel / Resort Site Script with OnLine Reservation System

Affected Version From:

Affected Version To:

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested:

2010

Hotel / Resort Site Script with OnLine Reservation System SQLi Vulnerable

The Hotel / Resort Site Script with OnLine Reservation System is vulnerable to SQL Injection. An attacker can exploit this vulnerability by injecting malicious SQL queries through the 'cat_id' parameter in the 'extrapage.php' file. This can lead to unauthorized access, data theft, and potential manipulation of the database.

Mitigation:

To mitigate this vulnerability, the vendor should sanitize and validate user input before using it in SQL queries. Implementing parameterized queries or prepared statements can help prevent SQL Injection attacks.

Source

Exploit-DB raw data:

Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com]
Exploit Title:Hotel / Resort Site Script with OnLine Reservation System
SQLi Vulnerable
Published: 2010-06-08
Vendor url:http://www.mformula.com.br
Greetz to:Sid3^effects, aa_Numb, M4n0j and to all ICW members

#############################################################################################################################################################################

DESCRIPTION:

Internal system for total administration of the site.
Available site in the languages Portuguese, Spanish, Japanese, English,
Italian, French & German.
System and reservation advanced search onnline/offline, Control of orders
and reservations, RSS/XML feed, Optimization in search engines, SiteMap
Google,
Yahoo and Bing, Support Inns, Hotel and Resorts, Unlimited Gallery of
Photos, Supported to any type of personalized option (Color, Size, Type,
etc), Tool of relationship between services, Tool of newsletters for
customers,
Personalization of the layout, colors and texts of the site in agreement
your mark, Reports detailed on the site
###############################################################################################################################################################################

Vulnerability:

contains SQLi Vulenrable.

demo:-
http://server/extrapage.php?cat_id=-1'[SQLi]

################################################################################################################################################################################
-- 
With R3gards,
L0rd CrusAd3r