phpCheckZ 1.1.0 Blind SQL Injection Vulnerability

vendor:

phpCheckZ

by:

Salvatore Fresta aka Drosophila

7,5

CVSS

HIGH

Blind SQL Injection

CWE

Product Name: phpCheckZ

Affected Version From: 1.1.0

Affected Version To: 1.1.0

Patch Exists: NO

Related CWE: N/A

CPE: a:phpcheckz:phpcheckz:1.1.0

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2010

phpCheckZ 1.1.0 Blind SQL Injection Vulnerability

A parameter is not properly sanitised before being used in a SQL query. Successful exploitation requires that 'magic_quotes_gpc' is disabled.

Mitigation:

No fix.

Source

Exploit-DB raw data:

phpCheckZ 1.1.0 Blind SQL Injection Vulnerability

 Name              phpCheckZ
 Vendor            http://www.phpcheckz.com
 Versions Affected 1.1.0

 Author            Salvatore Fresta aka Drosophila
 Website           http://www.salvatorefresta.net
 Contact           salvatorefresta [at] gmail [dot] com
 Date              2010-10-19

X. INDEX

 I.    ABOUT THE APPLICATION
 II.   DESCRIPTION
 III.  ANALYSIS
 IV.   SAMPLE CODE
 V.    FIX
 

I. ABOUT THE APPLICATION
________________________

phpCheckZ is a web application that allows you to  easily
create checklists for your website. 


II. DESCRIPTION
_______________

A parameter is not properly sanitised  before  being used
in a SQL query.


III. ANALYSIS
_____________

Summary:

 A) Blind SQL Injection
 

A) Blind SQL Injection
______________________

The parameters id in chart.php is  not properly sanitised
before being used in a SQL  query. This  can be exploited
to manipulate SQL queries by injecting arbitrary SQL code.

Successful exploitation  requires that "magic_quotes_gpc"
is disabled. 


IV. SAMPLE CODE
_______________

A) Blind SQL Injection

http://site/path/chart.php?id=1' AND '1'='1
http://site/path/chart.php?id=1' AND '1'='0


V. FIX
______

No fix.