Power-eCommerce SQL Injection Vulnerability

2020.05.12

Milad Karimi (IR)

Risk: Medium

Local: No

Remote: Yes

CVE: CWE-89

CWE: N/A

Dork: intext:"Powered by Power-eCommerce"

# Exploit Title: Power-eCommerce SQL Injection Vulnerability
# Date: 2020-05-09
# Author: Milad Karimi
# Contact: miladgrayhat@gmail.com
# Google Dork: intext:"Powered by Power-eCommerce"
# Version: All Version
# Tested on: windows 10 , firefox
# CVE : CWE-89

Vulnerable file

/ProductList.asp?ID=SQLi

Exploit

http://www.vuln.com/ProductList.asp?ID=SQLi

Demo: 

http://www.tonermill.com/ProductList.asp?ID=3571

************************
* ==> Contact Me :
* Telegram : @Ex3ptionaL
* Email : miladkarimi311@yahoo.com Email: miladgrayhat@gmail.com
* Instagram : @m.i.l.a.d_._k.a.r.i.m.i
************************ 

See this note in RAW Version

Vote for this issue:

100%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

Power-eCommerce SQL Injection Vulnerability

Dork: intext:"Powered by Power-eCommerce"

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.