Simplog SQL Injection Vulnerability

vendor:

Simplog

by:

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: Simplog

Affected Version From: 0.9.3.2

Affected Version To: Unknown

Patch Exists: YES

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested: Unknown

Simplog SQL Injection Vulnerability

The Simplog application is prone to an SQL-injection vulnerability due to improper sanitization of user-supplied input. An attacker can exploit this vulnerability to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

Mitigation:

Upgrade to a non-vulnerable version of the application.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/21843/info

Simplog is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

This issue affects version 0.9.3.2; other versions may also be vulnerable.

NOTE: This issue was previously discussed in BID 17652 (Simplog Multiple SQL Injection Vulnerabilities) and an upgrade is available from the vendor. However, new reports indicate the latest version of the application is still vulnerable to this issue.

http://example.com/simplog/archive.php?blogid=1&pid=1111%20union%20select%201,1,1,login,1,password,1,1%20from%20blog_users%20where%20admin=1