eNdonesia Portal SQL Injection Vulnerability in Banners.php

A SQL injection vulnerability has been identified in eNdonesia Portal version 8.7. This vulnerability allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious payloads through the 'bid' parameter. The exploitation occurs in the 'banners.php' file, where injected SQL can be used to extract sensitive information from the database's INFORMATION_SCHEMA tables.

Impact

Exploitation of this vulnerability allows for arbitrary SQL execution, which could lead to unauthorized data access or manipulation.

Reproduction

The vulnerability can be reproduced by sending a GET request to 'banners.php' with a crafted SQL payload in the 'bid' parameter. The injected SQL payload can be designed to extract data from the database, such as sensitive information from the INFORMATION_SCHEMA tables.