header-logo
Suggest Exploit
vendor:
webspell
by:
silent vapor
7,5
CVSS
HIGH
safe_query bypass
89
CWE
Product Name: webspell
Affected Version From: 4.X
Affected Version To: 4.X
Patch Exists: NO
Related CWE: N/A
CPE: a:webspell:webspell
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: PHP
2010

Webspell 4.X safe_query bypass Vulnerability

Webspell 4.X is vulnerable to a safe_query bypass vulnerability. This vulnerability allows an attacker to inject malicious SQL queries into the webspell_settings.php file via the 'function safe_query' parameter. The exploit can be triggered by using the '%20UNION+/**/+SELECT%20' payload.

Mitigation:

Ensure that all user-supplied input is properly sanitized and validated before being used in any SQL queries.
Source

Exploit-DB raw data:

################# INFORMATION ##################################################
+Name : Webspell 4.X safe_query bypass Vulnerability
+Author : silent vapor
+Date   : 29.09.2010
+Script  : webspell
+Price : free
+Language :PHP
+Discovered by silent vapor
+Underground Agents
+Greetz to Team-Internet, 4004-Security-Project, Easy Laster
################################################################################

+Vulnerability : webspell_settings.php "function safe_query"

+Exploitable   : %20UNION+/**/+SELECT%20

################################################################################

Navigation

Suggest Exploit

Services By CQR