City Directory Review And Rating Script SQL Injection

2012.12.25

Credit: 3spi0n

Risk: Medium

Local: No

Remote: Yes

CVE: N/A

CWE: CWE-89

# Exploit Title: City Directory Review and Rating Script SQL Injection Vulnerability
# Date: 22.12.2012
# Author: 3spi0n
# Script Vendor or Software Link: http://b-scripts.com/en/18-city-reviewer-yelp-clone.html
# Category: WebApps
# Type: SQL Injection [MySQLi]
# Tested On: Ubuntu 12.10 - Win7

=================================================
# Demo: http://b-scripts.com/demo/city_reviewer/

# MySQLi Detected On: http://b-scripts.com/demo/city_reviewer/search.php?category=6

# Other Demo Sites: http://www.bhookistan.com/

# MySQLi Detected On: http://www.bhookistan.com//search.php?category=6

=================================================

# My Blog: www.Ryuzaki.in
# Social : Twitter.com/bariiiscan
# My Team: Grayhatz Inc. & Agedz Corp.
# Turkey.

References:

http://b-scripts.com/en/18-city-reviewer-yelp-clone.html

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

City Directory Review And Rating Script SQL Injection

References:

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.