ECommerceMajor SQL Injection Vulnerability

From: Rahul Pratap Singh <techno.rps@gmail.com>
To: bugtraq@securityfocus.com
Cc:
Subject: ECommerceMajor SQL Injection Vulnerability
Date:

Attachments:
0x9ACF7D5F.asc

#Exploit Title   : ECommerceMajor SQL Injection Vulnerability
#Exploit Author  : Rahul Pratap Singh
#Date            : 13/Dec/2015
#Home page Link  : https://github.com/xlinkerz/ecommerceMajor
#Website        : 0x62626262.wordpress.com
#Linkedin        : https://in.linkedin.com/in/rahulpratapsingh94

1. Description

"prodid" field in productdtl.php is not properly sanitized, that leads
to SQL Injection Vulnerability.

2. Vulnerable Code:

line 14 to 18

<?php

$getallproduct="select * from purchase where id=$_GET[prodid] order by
id desc";
                             $getallproductresult=mysql_query($getallproduct);
                          $getallproducttotal=mysql_num_rows($getallproductresult);

3. POC

http://127.0.0.1/ecommercemajor/productdtl.php?prodid=SQLI




Copyright © 1995-2018 LinuxRocket.net. All rights reserved.