Description
SQL injection vulnerability in @1 File Store 2006.03.07 allows remote attackers to execute arbitrary SQL commands via the id parameter to (1) functions.php and (2) user.php in the libs directory, (3) edit.php and (4) delete.php in control/files/, (5) edit.php and (6) delete.php in control/users/, (7) edit.php, (8) access.php, and (9) in control/folders/, (10) access.php and (11) delete.php in control/groups/, (12) confirm.php, and (13) download.php; (14) the email parameter in password.php, and (15) the id parameter in folder.php. NOTE: it was later reported that vectors 12 and 13 also affect @1 File Store PRO 3.2.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- File Store PRO 3.2 - Multiple Blind SQL Injections EDB-6040 · webapps · Jul 11, 2008 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 23855 vdb-entry
- 23857 vdb-entry
- 23864 vdb-entry
- 31063 third-party-advisory
- 23863 vdb-entry
- 20060324 [eVuln] @1 File Store Multiple XSS and SQL Injection Vulnerabilities mailing-list
- 23852 vdb-entry
- ADV-2006-0943 vdb-entry
- 23861 vdb-entry
- filestore-multiple-sql-injection(25183) vdb-entry
- 19224 third-party-advisory
- 20090825 @1 File Store PRO SQL injection - the old gray dupe mailing-list
- filestorepro-id-sql-injection(43718) vdb-entry
- 23853 vdb-entry
- 23860 vdb-entry
- 23856 vdb-entry
- 1015826 vdb-entry
- 47018 vdb-entry
- 23858 vdb-entry
- 23854 vdb-entry
- 47017 vdb-entry
- filestorepro-download-file-include(43724) vdb-entry
- 17090 vdb-entry
- http://evuln.com/vulns/95/summary.html
- 23851 vdb-entry
- 23862 vdb-entry
- 6040 exploit
- 619 third-party-advisory
- 24106 vdb-entry
- 30182 vdb-entry
- 23859 vdb-entry