vendor:
ASPapp
by:
str0ke-D3ng3siz-pc faresi-s@bun-Hayalet-Turque-
7.5
CVSS
HIGH
SQL Injection
89
CWE
Product Name: ASPapp
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: NO
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2008
Iatek | ASPapp -links.asp (CatId) SQL Injection Vulnerability
A SQL injection vulnerability exists in Iatek | ASPapp -links.asp (CatId) which allows an attacker to gain access to the admin login page. The attacker can use the dork ''links.asp?CatId'' to find vulnerable websites and then use the exploit www.xxx.com/path/login.asp?ret_page=%2Fzmicer%2Fweb%2Fadmin%2Easp%3Flinks.asp?CatId=-99999%20UNION%20SELECT%20null,accesslevel,null,null,user_name,%205%20,password,null%20FROM%20Users to gain access to the admin login page.
Mitigation:
Ensure that user input is properly sanitized and validated before being used in a SQL query.
