1024 CMS 2.1.1 remote blind SQL injection vulnerability

2010-03-03 / 2010-03-04
Credit: AmnPardaz
Risk: Medium
Local: No
Remote: Yes
CVE: N/A
CWE: CWE-89

##########################www.BugReport.ir######################################## # # AmnPardaz Security Research Team # # Title: 1024CMS Blind SQL Injection Vulnerability # Vendor: http://www.1024cms.org/ # Vulnerable Version: 2.1.1 (Latest version till now) # Exploitation: Remote with browser # Fix: N/A ################################################################################### #################### - Description: #################### 1024CMS is a PHP-based CMS which uses MySQL as its backend DBMS. It support forums, downloads, search capability, BB code capability, gallery, chat and RSS services. #################### - Vulnerability: #################### +--> Blind SQL Injection The RSS page (rss.php) is vulnerable to SQL injection. The GET variable 'id' is not sanitized correctly in the SQL query. This hole can be used for extracting admin password. For details see 'Exploits' section. #################### - Exploits/PoCs: #################### http://www.bugreport.ir/69/exploit.htm #################### - Solution: #################### Remove rss.php and wait for bug fixation by vendor or escape GET parameter in file rss.php using the vendor string escaping function 'quote_smart' as is used in all of other files else of this one. #################### - Original Advisory: #################### http://www.bugreport.ir/index_69.htm #################### - Credit: #################### AmnPardaz Security Research & Penetration Testing Group Contact: admin[4t}bugreport{d0t]ir www.BugReport.ir www.AmnPardaz.com


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top