CMS Mundo 1.0 build 008 SQL Injection

2006.07.17
Credit: Secunia
Risk: Medium
Local: No
Remote: Yes
CWE: CWE-89


CVSS Base Score: 7.5/10
Impact Subscore: 6.4/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

====================================================================== Secunia Research 13/07/2006 - CMS Mundo SQL Injection Vulnerabilities - ====================================================================== Table of Contents Affected Software....................................................1 Severity.............................................................2 Description of Vulnerabilities.......................................3 Solution.............................................................4 Time Table...........................................................5 Credits..............................................................6 References...........................................................7 About Secunia........................................................8 Verification.........................................................9 ====================================================================== 1) Affected Software CMS Mundo 1.0 build 008 Other versions may also be affected. Product Link: http://www.hotwebscripts.com/index.php?mod=webshop&function= showDetails&id=76 ====================================================================== 2) Severity Rating: Moderately critical Impact: Manipulation of data Where: From remote ====================================================================== 3) Description of Vulnerabilities Secunia Research has discovered some vulnerabilities in CMS Mundo, which can be exploited by malicious people to conduct SQL injection attacks. Some input isn't properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. Examples: http://[host]/?mod=news&function=showNews&news_id=[code] http://[host]/?mod=search&function=doSearch&searchstring=[code] http://[host]/?mod=webshop&function=showDetails&id=[code] * The "username" parameter passed in index.php during customer login * The "Name", "Address", "Zip", "City", "Country", and "Email" fields when updating the user profile Successful exploitation requires that "magic_quotes_gpc" is disabled. ====================================================================== 4) Solution Edit the source code to ensure that input is properly sanitised. ====================================================================== 5) Time Table 30/05/2006 - Initial vendor notification. 28/06/2006 - Additional vulnerabilities reported to the vendor. 12/07/2006 - Final reminder. 13/07/2006 - Public disclosure. ====================================================================== 6) Credits Discovered by Andreas Sandblad, Secunia Research. ====================================================================== 7) References The Common Vulnerabilities and Exposures (CVE) project has assigned CVE-2006-3135 for the vulnerabilities. ====================================================================== 8) About Secunia Secunia collects, validates, assesses, and writes advisories regarding all the latest software vulnerabilities disclosed to the public. These advisories are gathered in a publicly available database at the Secunia website: http://secunia.com/ Secunia offers services to our customers enabling them to receive all relevant vulnerability information to their specific system configuration. Secunia offers a FREE mailing list called Secunia Security Advisories: http://secunia.com/secunia_security_advisories/ ====================================================================== 9) Verification Please verify this advisory by visiting the Secunia website: http://secunia.com/secunia_research/2006-52/advisory/ Complete list of vulnerability reports published by Secunia Research: http://secunia.com/secunia_research/ ======================================================================


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top