NCM Content Management System SQL Injection Vulnerability

vendor:

Content Management System

by:

SecurityFocus

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: Content Management System

Affected Version From: NCM Content Management System prior to version 2.0

Affected Version To: NCM Content Management System version 2.0

Patch Exists: YES

Related CWE: CVE-2001-0753

CPE: a:ncm:content_management_system

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: None

2001

NCM Content Management System SQL Injection Vulnerability

NCM Content Management System is vulnerable to SQL injection due to improper checking of input by the content.pl script. This vulnerability can be exploited by appending malicious SQL queries to valid URLs. For example, the following URL can be used to execute arbitrary SQL queries: http://www.TARGET/content.pl?group=49&id=140%20or%20id>0%20or%20ls_id<1000%20or%20kategorie<10000%20or%20kategorie>10%20or%20ls_id>1%20or%20id<10%20or%20kategorie<10%20or%20kategorie>4&shortdetail=1

Mitigation:

Upgrade to the latest version of NCM Content Management System.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/2584/info

The NCM Content Management System is a product distributed by NCM. The NCM Content Management System is designed to manage web material and other data, and provide an interface to databases from web resources.

A problem with the Content Management System could make it possible for a user to execute arbitrary SQL queries. Due to improper checking of input by the content.pl script, it may be possible to execute queries on tables within the database using the greater than and less than signs. This problem is in combination with the production version of the software package displaying information about the database upon receiving an invalid query, usual generated from a correct URL appended with an additional character.

Therefore, it is possible for a remote user to execute arbitrary SQL queries using the < and > signs, as well as gain more information by appending erroneous characters to the end of valid URLs. 

http://www.TARGET/content.pl?group=49&id=140a

http://www.TARGET/content.pl?group=49&id=140%20or%20id>0%20or%20ls_id<1000%20or%20kategorie<10000%20or%20kategorie>10%20or%20ls_id>1%20or%20id<10%20or%20kategorie<10%20or%20kategorie>4&shortdetail=1