CFAGCMS SQL Injection Exploit

vendor:

CFAGCMS

by:

cr4wl3r

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: CFAGCMS

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: GNU/LINUX

2009

CFAGCMS SQL Injection Exploit

The vulnerability exists due to insufficient sanitization of user-supplied input passed via the 'title' parameter to '/right.php' script. A remote attacker can execute arbitrary SQL commands in application's database, compromise the application, access or modify data, exploit vulnerabilities in the underlying database and gain access to the server.

Mitigation:

Input validation should be used to prevent SQL injection attacks. All user-supplied input should be validated and filtered before passing it to the database layer. It is recommended to use parameterized queries instead of dynamic SQL queries.

Source

Exploit-DB raw data:

################################################################################
## Exploit Title: CFAGCMS SQL Injection Exploit                               ##
## Date: 20-12-2009                                                           ##
## Author: cr4wl3r                                                            ##
## Software Link: http://sourceforge.net/project/showfiles.php?group_id=197936##
## Version: N/A                                                               ##
## Tested on: GNU/LINUX                                                       ##
################################################################################


~ Code [right.php]

$title  = $_GET['title'];
$query  = "SELECT * FROM pages WHERE title = '".$title."'";
$result = mysql_query($query);

~ PoC

[cfagcms_path]/right.php?title=[SQL]