header-logo
Suggest Exploit
vendor:
News Website Script
by:
Varun Bagaria
7.5
CVSS
HIGH
SQL Injection
89
CWE
Product Name: News Website Script
Affected Version From: 2.0.4
Affected Version To: 2.0.4
Patch Exists: NO
Related CWE: NA
CPE: 2.3:a:phpscriptsmall:news_website_script:2.0.4
Metasploit: N/A
Other Scripts: N/A
Platforms Tested: Windows 7
2018

News Website Script – SQL Injection (Error Based)

An attacker can exploit this vulnerability by inserting a malicious payload in the search parameter of the script. This will result in an error based SQL Injection.

Mitigation:

Input validation should be done to prevent SQL Injection attacks. Sanitizing user input is also recommended.
Source

Exploit-DB raw data:

##################################################################
# Exploit Title:News Website Script - SQL Injection (Error Based)
# Google Dork: NA
# Date: 12.02.2018
# Exploit Author: Varun Bagaria
# Vendor Homepage: https://www.phpscriptsmall.com/
# Software Link: *http://under24usd.com/demo/newstoday/index.php
# Version: 2.0.4
# Tested on: Windows 7
# Category: Webapps
# CVE : NA
##################################################################

Proof of Concept
=================

Attack Parameter : search
Payload : '

Reproduction Steps:
------------------------------
1. Access the script
2. In the search bar insert ' and you will get error based SQL Injection

Navigation

Suggest Exploit

Services By CQR