bugtraq - ECommerceMajor SQL Injection Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Sun, 13 Dec 2015 23:20:44 +0530
From: Rahul Pratap Singh <techno.rps@...il.com>
To: bugtraq@...urityfocus.com
Subject: ECommerceMajor SQL Injection Vulnerability

#Exploit Title   : ECommerceMajor SQL Injection Vulnerability
#Exploit Author  : Rahul Pratap Singh
#Date            : 13/Dec/2015
#Home page Link  : https://github.com/xlinkerz/ecommerceMajor
#Website	 : 0x62626262.wordpress.com
#Linkedin	 : https://in.linkedin.com/in/rahulpratapsingh94

1. Description

"prodid" field in productdtl.php is not properly sanitized, that leads
to SQL Injection Vulnerability.

2. Vulnerable Code:

line 14 to 18

<?php

$getallproduct="select * from purchase where id=$_GET[prodid] order by
id desc";
				$getallproductresult=mysql_query($getallproduct);
				$getallproducttotal=mysql_num_rows($getallproductresult);

3. POC

http://127.0.0.1/ecommercemajor/productdtl.php?prodid=SQLI

Download attachment "0x9ACF7D5F.asc" of type "application/pgp-keys" (3134 bytes)

Download attachment "signature.asc" of type "application/pgp-signature" (837 bytes)