Penny auction version - 5, SQLi Vulnerabilities

vendor:

Penny auction version - 5

by:

3spi0n

5.5

CVSS

MEDIUM

SQL Injection

CWE

Product Name: Penny auction version - 5

Affected Version From: Not mentioned

Affected Version To: Not mentioned

Patch Exists: NO

Related CWE: Not mentioned

CPE: Not mentioned

Metasploit:

Other Scripts:

Platforms Tested: Not mentioned

Not mentioned

Penny auction version – 5, SQLi Vulnerabilities

The vulnerability exists in the 'show' parameter of the 'index.php' file. An attacker can exploit this by injecting SQL queries in the 'id' parameter, potentially allowing unauthorized access to the database.

Mitigation:

The developer should use prepared statements or parameterized queries to prevent SQL injection attacks. User input should be properly sanitized and validated before using it in SQL queries.

Source

Exploit-DB raw data:

##################################################################################
  _____                 _       _   _                _____           
 |  __ \               | |     | | (_)              / ____|          
 | |__) |_____   _____ | |_   _| |_ _  ___  _ __   | (___   ___  ___ 
 |  _  // _ \ \ / / _ \| | | | | __| |/ _ \| '_ \   \___ \ / _ \/ __|
 | | \ \  __/\ V / (_) | | |_| | |_| | (_) | | | |  ____) |  __/ (__ 
 |_|  \_\___| \_/ \___/|_|\__,_|\__|_|\___/|_| |_| |_____/ \___|\___|
                                                                                                                                        
##################################################################################                                
Penny auction version - 5, SQLi Vulnerabilities
Product Page: http://www.auctionwebsitescript.com/penny_auction_v5.html
Script Demo: http://pennyauction-ver5.auctionwebsitescript.com

Author(Pentester): 3spi0n
On Web: RevolutionSec.Com - Janissaries.Org
On Social: Twitter.Com/eyyamgudeer
##################################################################################

[+] (index.php, show Param)
>>> [url]/index.php?show=product_penny&id='89