PHP Classifieds Version 7.5 Blind SQL Injection

vendor:

PHP Classifieds

by:

ItSecTeam

7.5

CVSS

HIGH

Blind SQL Injection

Not mentioned

CWE

Product Name: PHP Classifieds

Affected Version From: PHP Classifieds version 7.5

Affected Version To: Not mentioned

Patch Exists: NO

Related CWE: Not mentioned

CPE: Not mentioned

Metasploit:

Other Scripts:

Platforms Tested: Not mentioned

Not mentioned

PHP Classifieds Version 7.5 Blind SQL Injection

The ItSecTeam has discovered a blind SQL injection vulnerability in PHP Classifieds version 7.5. The vulnerability allows an attacker to inject SQL code through the 'bid' parameter in the 'ad_click.php' file. The vulnerable code fails to properly sanitize user input, allowing the attacker to execute arbitrary SQL queries on the database.

Mitigation:

To mitigate this vulnerability, it is recommended to sanitize and validate user input before using it in SQL queries. Additionally, using prepared statements or parameterized queries can help prevent SQL injection attacks.

Source

Exploit-DB raw data:

Dear Sir / Madam
The ItSecTeam has discovered a new bug in  PHP Classifieds Lastest Version and will be glad to report and public it .
More information about this bug is listed below :
=======================================================================================
Topic : PHP Classifieds Version 7.5
Bug type : Blind SQL Injection
Author : ItSecTeam
Remote : Yes
Status   : Bug
===================== Content ======================
( # Advisory Content : PHP Classifieds
( # Mail : Bug@ItSecTeam.com
( # Find By : Amin Shokohi(Pejvak!)
( # Special Tnx : M3hr@n.S , 0xd41684c654 And All Team Members!
( # Website : WwW.ItSecTeam.com
( # Forum : WwW.Forum.ItSecTeam.com

=================================================
============================================= Exploit 1 =======================================
( * http://localhost/phpClassifieds v7.5/ad_click.php?bid=2 SQL Injection Code
----------------------------------------------------------------------------------
<BUG>
  $bid=getParam("bid","");
if ($bid>0)
{
    $sql_banner = "SELECT goto_url FROM $banner_tbl WHERE bid=****$bid****";
........}
</Bug>
----------------------------------------------------------------------------------
===========================================================================================