{"sourceData": "Document Title:\r\n===============\r\nTop Business Advertising - SQL Injection Vulnerabilities\r\n\r\n\r\nReferences (Source):\r\n====================\r\nhttp://www.vulnerability-lab.com/get_content.php?id=1786\r\n\r\n\r\nRelease Date:\r\n=============\r\n2016-03-20\r\n\r\n\r\nVulnerability Laboratory ID (VL-ID):\r\n====================================\r\n1786\r\n\r\n\r\nCommon Vulnerability Scoring System:\r\n====================================\r\n7\r\n\r\n\r\nProduct & Service Introduction:\r\n===============================\r\nhttp://www.topbusinessadv.com\r\n\r\n\r\nAbstract Advisory Information:\r\n==============================\r\nAn independent vulnerability laboratory researcher of the iran cyber security group discovered multiple remote sql injection vulnerabilities in the Top Business Advertising web-application.\r\n\r\n\r\nVulnerability Disclosure Timeline:\r\n==================================\r\n2016-03-21: Public Disclosure (Vulnerability Laboratory)\r\n\r\n\r\nDiscovery Status:\r\n=================\r\nPublished\r\n\r\n\r\nExploitation Technique:\r\n=======================\r\nRemote\r\n\r\n\r\nSeverity Level:\r\n===============\r\nHigh\r\n\r\n\r\nTechnical Details & Description:\r\n================================\r\nA remote sql injection web vulnerability has been discovered in the Top Business Advertising web-application (2016 Q1).\r\nThe vulnerability allows remote attackers to execute own sql commands to compromise the web-applicaation or connected dbms.\r\n\r\nThe vulnerabilities are located in the `newsid` value of the `aboutus.php`,`contactus.php`,`newsdetail.php`,`productdetail.php`\r\nand `services.php` files. Remote attackers are able to execute sql commands by injection of malicious statements via GET method request. \r\nThe vulnerability is located on the application-side and the request method to inject/execute is GET. The security vulnerability is a \r\nclassic order by sql injection in the `newsid` value. \r\n\r\nThe security risk of the sql injection vulnerability is estimated as high with a cvss (common vulnerability scoring system) count of 7.0.\r\nExploitation of the remote sql injection web vulnerability requires no user interaction or privileged web-application user accounts.\r\nSuccessful exploitation of the remote sql injection results in database management system, web-server and web-application compromise.\r\n\r\nRequest Method(s):\r\n\t\t\t\t[+] GET\r\n\r\nVulnerable File(s):\r\n\t\t\t\t[+] aboutus.php\r\n\t\t\t\t[+] contactus.php\r\n\t\t\t\t[+] newsdetail.php\r\n\t\t\t\t[+] productdetail.php\r\n\t\t\t\t[+] services.php\r\n\r\nVulnerable Parameter(s):\r\n\t\t\t\t[+] newsid\r\n\r\n\r\nProof of Concept (PoC):\r\n=======================\r\nThe sql injection web vulnerabilities can be exploited by remote attackers without privileged web-application user account or user interaction.\r\nFor security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue.\r\n\r\nGoogle Dork(s):\r\nintext:Powered By Top Business Advertising inurl:.php?newsId=\r\n\r\nPoC: Exploitation\r\nhttp://localhost:8080/aboutus.php?newsid=Xgovernment-lab[SQL-INJECTION VULNERABILITY]--\r\nhttp://localhost:8080/contactus.php?newsid=Xgovernment-lab[SQL-INJECTION VULNERABILITY]--\r\nhttp://localhost:8080/newsdetail.php?newsid=Xgovernment-lab[SQL-INJECTION VULNERABILITY]--\r\nhttp://localhost:8080/productdetail.php?newsid=Xgovernment-lab[SQL-INJECTION VULNERABILITY]--\r\nhttp://localhost:8080/services.php?newsid=Xgovernment-lab[SQL-INJECTION VULNERABILITY]--\r\n\r\n\r\nSolution - Fix & Patch:\r\n=======================\r\nThe vulnerability can be patched by usage of a prepared statement in the newsid value GET method request of the aboutus.php, \r\ncontactus.php, newsdetail.php, productdetail.php and services.php files.\r\nEncode or escape the input of the paramter value and disallow special chars in the GET method request.\r\n\r\n\r\nSecurity Risk:\r\n==============\r\nThe security risk of the remote sql injection web vulnerabilities in the web-application are estimated as high. (CVSS 7.0)\r\n\r\n\r\nCredits & Authors:\r\n==================\r\nIran Cyber Security Group - 0x3a (ICG SEC) [Iran-Cyber.Net] [http://www.vulnerability-lab.com/show.php?user=Iran%20Cyber%20Security]\r\nWe Are : MOHAMMAD-NOFOZI , root3r , jok3r , pi.hack , 0day , whitewolf , MrS4jj4d , MoHaMad-Bl4ck , l3gi0n , mr.turk , nazanin_wild , Pr0mis , 0xdevil , king_k4li\r\n\r\n\r\nDisclaimer & Information:\r\n=========================\r\nThe information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either expressed or implied, \r\nincluding the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers are not liable in any case of damage, \r\nincluding direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab or its suppliers have been advised \r\nof the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing \r\nlimitation may not apply. We do not approve or encourage anybody to break any licenses, policies, deface websites, hack into databases or trade with stolen data.\r\n\r\nDomains: www.vulnerability-lab.com \t\t- www.vuln-lab.com \t\t\t\t\t\t- www.evolution-sec.com\r\nContact: admin@vulnerability-lab.com \t- research@vulnerability-lab.com \t\t\t\t- admin@evolution-sec.com\r\nSection: magazine.vulnerability-lab.com \t- vulnerability-lab.com/contact.php \t\t\t\t- evolution-sec.com/contact\r\nSocial:\t twitter.com/vuln_lab\t\t- facebook.com/VulnerabilityLab \t\t\t\t- youtube.com/user/vulnerability0lab\r\nFeeds:\t vulnerability-lab.com/rss/rss.php \t- vulnerability-lab.com/rss/rss_upcoming.php \t\t\t- vulnerability-lab.com/rss/rss_news.php\r\nPrograms: vulnerability-lab.com/submit.php \t- vulnerability-lab.com/list-of-bug-bounty-programs.php \t- vulnerability-lab.com/register.php\r\n\r\nAny modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to electronically \r\nredistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by Vulnerability-Lab Research Team or \r\nits suppliers. All pictures, texts, advisories, source code, videos and other information on this website is trademark of vulnerability-lab team & the specific \r\nauthors or managers. To record, list, modify, use or edit our material contact (admin@ or research@vulnerability-lab.com) to get a ask permission.\r\n\r\n\t\t\t\t Copyright \u00a9 2016 | Vulnerability Laboratory - [Evolution Security GmbH]\u2122\r\n\r\n\r\n\r\n", "description": "", "reporter": "Iran Cyber Security Group - 0x3a (ICG SEC) [Iran-Cyber.Net] [http://www.vulnerability-lab.com/show.php?user=Iran%20Cyber%20Security]\r\nWe Are : MOHAMMAD-NOFOZI , root3r , jok3r , pi.hack , 0day , whitewolf , MrS4jj4d , MoHaMad-Bl4ck , l3gi0n , mr.turk , nazanin_wild , Pr0mis , 0xdevil , king_k4li", "href": "http://www.vulnerability-lab.com/get_content.php?id=1786", "type": "vulnerlab", "viewCount": 3, "references": [], "lastseen": "2019-07-10T16:42:11", "published": "2016-03-20T00:00:00", "cvelist": [], "id": "VULNERLAB:1786", "modified": "2016-03-20T00:00:00", "title": "Top Business Advertising - SQL Injection Vulnerabilities", "edition": 3, "cvss": {"score": 0.0, "vector": "NONE"}, "bulletinFamily": "exploit", "enchantments": {"dependencies": {"references": [], "modified": "2019-07-10T16:42:11", "rev": 2}, "score": {"value": 0.6, "vector": "NONE", "modified": "2019-07-10T16:42:11", "rev": 2}, "vulnersScore": 0.6}, "scheme": null}

{}