BlackNova Traders SQL Injection

2013.02.13

Credit: ITTIHACK

Risk: Medium

Local: No

Remote: Yes

CVE: N/A

CWE: CWE-89

BlackNova Traders (SQL Injection) Vulnerability
Software : BlackNova
Date : 2/12/2013
Vendor : http://blacknova.net/
Download : http://sourceforge.net/projects/blacknova/
Language : PHP
Tested on: Windows OS + Apache Server
Author : ITTIHACK
Home : http://ittihack.com
Description
BlackNova Traders is a web-based, multi-player space exploration game inspired by the
popular BBS game of TradeWars. It is coded using PHP, SQL, and Javascript.
Vulnerable File: news.php
Line# 43 : if (array_key_exists('startdate', $_GET) && ($_GET['startdate'] != ''))
Exploit:
http://localhost/bnt/news.php?startdate=2013/02/11[SQLi]
Free Syria

References:

http://blacknova.net/

http://sourceforge.net/projects/blacknova/

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

BlackNova Traders SQL Injection

References:

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.