Wapkul Beta 3 SQL Injection Vulnerability

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1044372 漏洞类型
发布时间 2013-10-01 更新时间 2013-10-01
CVE编号 N/A CNNVD-ID N/A
漏洞平台 N/A CVSS评分 N/A
|漏洞来源
https://cxsecurity.com/issue/WLB-2013100002
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
#####################
 
  ______                                __                                       ______                     
 /      \                              /  |                                     /      \                    
/000000  |  ______    ______   ______  00 |____   _____  ____    ______        /000000  |  ______    _______
00 \__00/  /      \  /      \ /      \ 00      \ /     \/    \  /      \       00 \__00/  /      \  /       |
00      \  000000  |/000000  |000000  |0000000  |000000 0000  | 000000  |      00      \ /000000  |/0000000/
 000000  | /    00 |00 |  00/ /    00 |00 |  00 |00 | 00 | 00 | /    00 |       000000  |00    00 |00 |     
/  \__00 |/0000000 |00 |     /0000000 |00 |  00 |00 | 00 | 00 |/0000000 |      /  \__00 |00000000/ 00 \_____
00    00/ 00    00 |00 |     00    00 |00 |  00 |00 | 00 | 00 |00    00 |      00    00/ 00       |00       |
 000000/   0000000/ 00/       0000000/ 00/   00/ 00/  00/  00/  0000000/        000000/   0000000/  0000000/
     

#####################
 
Product: Wapkul Beta 3 SQL Injection Vulnerability
Vendor: Wapkul
Vendor Notification: Sept 3, 2013
Public Disclosure: Sept 10, 2013
Vulnerability Type: Sql Injection
Risk Level: High
 
Discovered and Provided By:
Sarahma Security
Website : wwww.sarahma.co.id
Email : research@sarahma.co.id
 
 
========================
SQL Injection
========================
Found on Index.php at p parameter
http://localhost/wapkul/index.php?p=1{SQL_HERE}
 
========================
Solution :
========================
No Update Until This Advisory published
 
========================
Timeline:
========================
2013-09-03 Provided details vulnerability to vendor
2013-09-07 No Response From vendor
2013-09-08 Advisory published