Advisory: SQL-Injection in administrative Backend of Sefrengo CMS v.1.6.0
The Content Management System Sefrengo v.1.6.0 contains SQL-Injection vulnerabilities in its administrative Backend. The administrative Backend of Sefrengo CMS contains a functionality to edit folders which reside on the CMS. Its located here: http://{TARGET}/backend/main.php?area=con_configcat&idcat=1&idtplconf=0. The parameter „idcat“ ist vulnerable against SQL-Injection. An attacker could abuse this to send crafted URLs to the administrator via mail to execute own SQL commands (e.g. create a second admin-account). Another SQL-Injection vulnerability can be found in the administrative backend, where the admin can manage installed plugins. The vulnerable parameter is „idclient“ in the following URL: http://{TARGET}/backend/main.php?area=plug&idclient=1.
