vendor:
YenerTurk Haber Script
by:
ASIANEAGLE
7,5
CVSS
HIGH
SQL Injection
89
CWE
Product Name: YenerTurk Haber Script
Affected Version From: v1.0
Affected Version To: v1.0
Patch Exists: NO
Related CWE: N/A
CPE: a:yenerturk:yenerturk_haber_script
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2006
YenerTurk Haber Script v1.0 SQL Injection Vulnebrality
An attacker can exploit a SQL injection vulnerability in YenerTurk Haber Script v1.0 to gain access to the admin credentials. By sending a specially crafted HTTP request to the vulnerable application, an attacker can execute arbitrary SQL commands in the back-end database. This can be exploited to gain access to the admin credentials by sending a request to the vulnerable application containing the following payload: '-1 union select 0,kullanici_adi,2,3,4,5,6,7,8 from admin where id like 1' and '-1 union select 0,sifre,2,3,4,5,6,7,8 from admin where id like 1'
Mitigation:
Developers should always use parameterized queries to prevent SQL injection attacks. Additionally, input validation should be performed to ensure that user-supplied data does not contain malicious SQL commands.
