Willscript Auction Website Script 'category.php' SQL Injection Vulnerability
BID:43254
Info
Willscript Auction Website Script 'category.php' SQL Injection Vulnerability
| Bugtraq ID: | 43254 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 06 2009 12:00AM |
| Updated: | Aug 06 2009 12:00AM |
| Credit: | 599eme Man |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
Willscript Auction Website Script 'category.php' SQL Injection Vulnerability
Willscript Auction Website Script is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to execute arbitrary code, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Willscript Auction Website Script is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to execute arbitrary code, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Exploit / POC
Willscript Auction Website Script 'category.php' SQL Injection Vulnerability
Attackers can use a browser to exploit this issue.
The following example URI is available:
http://www.example.com/webtrade/category.php?cate_id=-19%20union%20all%20select%201,version%28
Attackers can use a browser to exploit this issue.
The following example URI is available:
http://www.example.com/webtrade/category.php?cate_id=-19%20union%20all%20select%201,version%28