Portel (patron) Blind SQL-injection Vulnerability
Portel is a content management system (CMS) developed by a Colombian company. It is vulnerable to Blind SQL injection, which allows an attacker to execute arbitrary SQL commands on the underlying database. An attacker can exploit this vulnerability by sending malicious SQL queries to the vulnerable application. For example, an attacker can send a malicious SQL query to the vulnerable application as follows: http://localHost/path/libreria/php/decide.php?patron=n<Blind Sql Code>, where n is a valid patron. This can be demonstrated by sending the following requests to the vulnerable application: http://www.bogota.gov.co/portel/libreria/php/decide.php?patron=01.'+and+1=1/* (true) and http://www.bogota.gov.co/portel/libreria/php/decide.php?patron=01.'+and+1=2/* (false).
