Sefrengo CMS 1.6.0 SQL Injection

2015-01-07 / 2015-04-19
Credit: Steffen R
Risk: Medium
Local: No
Remote: Yes
CWE: CWE-89


CVSS Base Score: 7.5/10
Impact Subscore: 6.4/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

Advisory: SQL-Injection in administrative Backend of Sefrengo CMS v.1.6.0 Advisory ID: SROEADV-2015-04 Author: Steffen Rsemann Affected Software: CMS Sefrengo v.1.6.0 (Release-Date: 18th-Feb-2014) Vendor URL: http://www.sefrengo.org/start/start.html Vendor Status: fixed CVE-ID: - ========================== Vulnerability Description: ========================== The Content Management System Sefrengo v.1.6.0 contains SQL-Injection vulnerabilities in its administrative Backend. ================== Technical Details: ================== The administrative Backend of Sefrengo CMS contains a functionality to edit folders which reside on the CMS. Its located here: http://{TARGET}/backend/main.php?area=con_configcat&idcat=1&idtplconf=0 The parameter ?idcat? ist vulnerable against SQL-Injection. An attacker could abuse this to send crafted URLs to the administrator via mail to execute own SQL commands (e.g. create a second admin-account). Exploit-Example: http:// {TARGET}/backend/main.php?area=con_configcat&idcat=1'+and+'1'='2'+union+select+version(),user(),3,4+--+&idtplconf=0 Another SQL-Injection vulnerability can be found in the administrative backend, where the admin can manage installed plugins. The vulnerable parameter is ?idclient? in the following URL: http://{TARGET}/backend/main.php?area=plug&idclient=1 Exploit-Example: http:// {TARGET}/backend/main.php?area=plug&idclient=1%27+and+%271%27=%272%27+union+select+1,version%28%29,user%28%29,4,database%28%29,6,7,8,9,10,11,12,13,14+--+ ========= Solution: ========= Update to the latest version ==================== Disclosure Timeline: ==================== 21-Dec-2014 ?found the vulnerability 21-Dec-2014 - informed the developers 22-Dec-2014 - response by vendor 04-Jan-2015 ? fix by vendor 04-Jan-2015 - release date of this security advisory 04-Jan-2015 - post on BugTraq / FullDisclosure ======== Credits: ======== Vulnerability found and advisory written by Steffen Rsemann. =========== References: =========== http://www.sefrengo.org/start/start.html http://sroesemann.blogspot.de


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top