My Kazaam Address & Contact Organizer SQL Injection Vulnerability

vendor:

Address & Contact Organizer

by:

v3n0m

7,5

CVSS

HIGH

SQL Injection

CWE

Product Name: Address & Contact Organizer

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: N/A

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2010

My Kazaam Address & Contact Organizer SQL Injection Vulnerability

A vulnerability exists in My Kazaam Address & Contact Organizer, which allows an attacker to inject arbitrary SQL commands via the 'var1' parameter in the 'contacts.php' script. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code in the 'var1' parameter value.

Mitigation:

Input validation should be used to prevent SQL injection attacks.

Source

Exploit-DB raw data:

     )   )            )                     (   (         (   (    (       )     ) 
  ( /(( /( (       ( /(  (       (    (     )\ ))\ )      )\ ))\ ) )\ ) ( /(  ( /( 
  )\())\()))\ )    )\()) )\      )\   )\   (()/(()/(  (  (()/(()/((()/( )\()) )\())
 ((_)((_)\(()/(   ((_)((((_)(  (((_)(((_)(  /(_))(_)) )\  /(_))(_))/(_))(_)\|((_)\ 
__ ((_)((_)/(_))___ ((_)\ _ )\ )\___)\ _ )\(_))(_))_ ((_)(_))(_)) (_))  _((_)_ ((_)
\ \ / / _ (_)) __\ \ / (_)_\(_)(/ __(_)_\(_) _ \|   \| __| _ \ |  |_ _|| \| | |/ / 
 \ V / (_) || (_ |\ V / / _ \  | (__ / _ \ |   /| |) | _||   / |__ | | | .` | ' <  
  |_| \___/  \___| |_| /_/ \_\  \___/_/ \_\|_|_\|___/|___|_|_\____|___||_|\_|_|\_\
										.WEB.ID
-----------------------------------------------------------------------
  My Kazaam Address & Contact Organizer SQL Injection Vulnerability
-----------------------------------------------------------------------
Author  	: v3n0m
Site    	: http://yogyacarderlink.web.id/
Date		: July, 11-2010
Location	: Jakarta, Indonesia
Time Zone	: GMT +7:00
----------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~

Application	: Address & Contact Organizer
Vendor  	: http://www.mykazaam.com/
Description	:

Numerous search features with overview and expanded view results. Lots 
of neat features built in, has been compared to ACT.
----------------------------------------------------------------

Poc:
~~~~~~~

http://127.0.0.1/[path]/address_book/contacts.php?var1=[SQLi]

----------------------------------------------------------------

WWW.YOGYACARDERLINK.WEB.ID | v3n0m666[at]live[dot]com

---------------------------[EOF]--------------------------------