OrderSys - exploit.company

vendor:

OrderSys

by:

muuratsalo

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: OrderSys

Affected Version From: 1.6.2004

Affected Version To: 1.6.2004

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2011

OrderSys <= 1.6.4 Sql Injection Vulnerabilities

All versions of OrderSys <= 1.6.4 are affected by Sql injection vulnerabilities. A valid account could be required to exploit the vulnerabilities. Proof of Concept: http://localhost/ordersys/ordering/interface_creator/index.php?table_name=vendor&function=search&where_clause=[SQL INJECTION]&page=0&order=Address&order_type=ASC http://localhost/ordersys/ordering/interface_creator/index_long.php?table_name=vendor&function=search&where_clause=[SQL INJECTION]&page=0&order=Address&order_type=ASC http://localhost/ordersys/ordering/interface_creator/index_short.php?table_name=vendor&function=search&where_clause=[SQL INJECTION]&page=0&order=Address&order_type=ASC

Mitigation:

The vendor is currently working on fixing the reported issues.

Source

Exploit-DB raw data:

	    ------------------------------------------------------------------------
	    OrderSys <= 1.6.4 Sql Injection Vulnerabilities
	    ------------------------------------------------------------------------
     
	    author............: muuratsalo (Revshell.com)
	    contact...........: muuratsalo[at]gmail[dot]com
	    download..........: http://www.bioinformatics.org/phplabware/labwiki/index.php
    
     
	    [0x01] Vulnerability overview:

	    All versions of OrderSys <= 1.6.4 are affected by Sql injection vulnerabilities.
	    A valid account could be required to exploit the vulnerabilities.
     
	    [0x02] Disclosure timeline:
     
	    [04/11/2011] - Multiple sql injection vulnerabilities discovered and reported to the vendor
	    [05/11/2011] - Multiple sql injection vulnerabilities fixed, OrderSys 1.6.4 released. 
            [05/11/2011] - OrderSys 1.6.4 is still vulnerable to some sql injection vulnerabilities.
	    [05/11/2011] - The vendor is currently working on fixing the reported issues.
	    [06/11/2011] - Public disclosure

	    [0x03] Proof of Concept:
              
            http://localhost/ordersys/ordering/interface_creator/index.php?table_name=vendor&function=search&where_clause=[SQL INJECTION]&page=0&order=Address&order_type=ASC
            http://localhost/ordersys/ordering/interface_creator/index_long.php?table_name=vendor&function=search&where_clause=[SQL INJECTION]&page=0&order=Address&order_type=ASC
            http://localhost/ordersys/ordering/interface_creator/index_short.php?table_name=vendor&function=search&where_clause=[SQL INJECTION]&page=0&order=Address&order_type=ASC