Advisory: SQL injection vulnerability in Pragyan CMS v.3.0 Advisory ID: SROEADV-2015-11 Author: Steffen Rsemann Affected Software: Pragyan CMS v.3 Vendor URL: https://github.com/delta/pragyan, http://delta.nitt.edu/ Vendor Status: vendor did not respond after initial communication CVE-ID: - ========================== Vulnerability Description: ========================== Pragyan CMS v. 3 suffers from a SQL injection vulnerability that can be abused even by unauthenticated attackers. ================== Technical Details: ================== The user-profile of registered users of Pragyan CMS v.3 is vulnerable to SQL injection attacks. A user-profile can be found in the following location of a common Pragyan CMS installation: http://{TARGET}/user:1 Exploit-Example: http:// {TARGET}/user:1%27+and+1=2+union+select+database%28%29,version%28%29,3+--+ ========= Solution: ========= Vendor notified, did not respond after initial communication. If you use Pragyan CMS v.3, please locate the file userprofile.lib.php and use my patch (see [5], usage at your own risk!). ==================== Disclosure Timeline: ==================== 18-Jan-2015 ? found the vulnerability 19-Jan-2015 - informed the developers (see [3]) 19-Jan-2015 ? release date of this security advisory [without technical details] 19-Jan-2015 - forked the project to keep it available/researchable in its current state for other researchers [4] 03-Feb-2015 - release date of this security advisory 03-Feb-2015 - provided a patch for vulnerability (see [5]) 03-Feb-2015 - send to FullDisclosure ======== Credits: ======== Vulnerability found and advisory written by Steffen Rsemann. =========== References: =========== [1] http://delta.nitt.edu/ / https://github.com/delta/pragyan [2] http://sroesemann.blogspot.de/2015/01/sroeadv-2015-11.html [3] https://github.com/delta/pragyan/issues/206 [4] https://github.com/sroesemann/pragyan [5] http://pastebin.com/ip2gGYuS