Description
SQL injection vulnerability in info.php in Mole Group Airline Ticket Sale Script allows remote attackers to execute arbitrary SQL commands via the flight parameter. NOTE: the vendor has disputed this issue, stating "crazy hackers and so named Security companies [spread] out such false informations. Such scripts or versions [do not] exist.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Mole Group Airline Ticket Script - SQL Injection EDB-7009 · webapps · Nov 5, 2008 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 32577 third-party-advisory
- 32138 vdb-entry
- 7009 exploit
- http://www.mole-group.com/content/view/57/72
- ADV-2008-3027 vdb-entry
- 49694 vdb-entry
- airlineticket-info-sql-injection(46383) vdb-entry