Movie Portal Script v7.35 - SQL Injection Web Vulnerability

vendor:

Movie Portal Script

by:

Ihsan Sencan

7,5

CVSS

HIGH

SQL Injection

CWE

Product Name: Movie Portal Script

Affected Version From: v7.35

Affected Version To: v7.35

Patch Exists: NO

Related CWE: N/A

CPE: a:itechscripts:movie_portal_script

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2017

Movie Portal Script v7.35 – SQL Injection Web Vulnerability

The vulnerability exists in the Movie Portal Script v7.35, allowing an attacker to inject malicious SQL queries via the 'a' and 'f' parameters in the 'artist.php' and 'movie.php' files respectively. Other files may also be vulnerable.

Mitigation:

Input validation should be used to prevent SQL injection attacks.

Source

Exploit-DB raw data:

# # # # # 
# Vulnerability: Movie Portal Script v7.35 - SQL Injection Web Vulnerability
# Google Dork: Movie Portal Script
# Date:11.01.2017
# Vendor Homepage: http://itechscripts.com/movie-portal-script/
# Script Name: Movie Portal Script
# Script Version: v7.35
# Script Buy Now: http://itechscripts.com/movie-portal-script/
# Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
# 
# SQL Injection/Exploit :
# http://localhost/[PATH]/artist.php?a=[SQL]
# http://localhost/[PATH]/movie.php?f=[SQL]
# E.t.c.... Other files, too. There are security vulnerabilities.
# Category,User E.t.c.. Add/Edit/Delete There are security vulnerabilities.
# # # # #