HoloCMS 9.0.47 (news.php) SQL Injection Vulnerability

vendor:

HoloCMS

by:

GlaDiaT0R

CVSS

HIGH

SQL Injection

CWE

Product Name: HoloCMS

Affected Version From: 9.0.47

Affected Version To: 9.0.47

Patch Exists: Yes

Related CWE: N/A

CPE: holocms

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

HoloCMS 9.0.47 (news.php) SQL Injection Vulnerability

HoloCMS 9.0.47 is vulnerable to a SQL injection vulnerability in the news.php page. An attacker can exploit this vulnerability by sending a specially crafted HTTP request with malicious SQL code to the vulnerable page. This can allow the attacker to gain access to sensitive information stored in the database, such as user credentials and other confidential data.

Mitigation:

The vendor has released a patch to address this vulnerability. Users should upgrade to the latest version of HoloCMS to mitigate this vulnerability.

Source

Exploit-DB raw data:

##############################################################################
# [+]Title: [HoloCMS  9.0.47  (news.php) SQL Injection Vulnerability]
##############################################################################
# [+] About :
##############################################################################
# Author :  GlaDiaT0R  
# Contact: the_gl4di4t0r[AT]hotmail[DOT]com or berrahal.ryadh[AT]gmail[DOT]com
# Team :  Tunisian Power Team 
# Greetz : ALLAH ! , Boomrang_victim, Marwen_Neo, Alphanix, Zigma & my friends
##############################################################################
# Software Link: http://www.assembla.com/wiki/show/holocms
# Category:  webapps/0day 
##############################################################################

=======================

Poc : http://localhost.com/news.php?id=[SQLi]

=======================

###########################################
Notice: I'M MUSLIM
###########################################