ECommerceMajor - productdtl.php, prodid param SQL Injection Vulnerability

ID EDB-ID:38965
Type exploitdb
Reporter Rahul Pratap Singh
Modified 2015-12-14T00:00:00


ECommerceMajor - (productdtl.php, prodid param) SQL Injection Vulnerability. Webapps exploit for php platform

                                            #Exploit Title      : ECommerceMajor SQL Injection Vulnerability
#Exploit Author  : Rahul Pratap Singh
#Date                 : 13/Dec/2015
#Home page Link  :
#Website            :
#Linkedin :

1. Description

"prodid" field in productdtl.php is not properly sanitized, that leads to
SQL Injection Vulnerability.

2. Vulnerable Code:

line 14 to 28

$getallproduct="select * from purchase where id=$_GET[prodid] order by id

3. POC