Esselbach Storyteller CMS System Version 1.8 [page.php] Remote SQL Injection Vulnerability

vendor:

Storyteller CMS System

by:

Shamus

N/A

CVSS

N/A

SQL Injection

CWE

Product Name: Storyteller CMS System

Affected Version From: 1.8

Affected Version To: 1.8

Patch Exists: NO

Related CWE: N/A

CPE: a:esselbach:storyteller_cms_system

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows

2011

Esselbach Storyteller CMS System Version 1.8 [page.php] Remote SQL Injection Vulnerability

A weakness has been discovered in Esselbach Storyteller CMS System Version 1.8, where an attacker may execute arbitrary SQL statements on the vulnerable system. This may compromise the integrity of the database and/or expose sensitive information. This vulnerability is identified in the path 'page.php'.

Mitigation:

Filter metacharacters from user inputs.

Source

Exploit-DB raw data:

# Exploit Title: Esselbach Storyteller CMS System Version 1.8 [page.php] Remote SQL Injection Vulnerability
# Date: March, 9th 2011 [GMT +7]
# Author: Shamus
# Software Link: http://www.esselbach.com/
# Version : Esselbach Storyteller CMS System Version 1.8
# Tested on: windows
# CVE : -

-----------------------------------------------------------------------------------------
Esselbach Storyteller CMS System Version 1.8 [page.php] Remote SQL Injection Vulnerability
-----------------------------------------------------------------------------------------

Author : Shamus
Date : March, 9th 2011 [GMT +7]
Location : Solo && Jogjakarta, Indonesia
Web : http://antijasakom.net/forum
Critical Lvl : Moderate
Impact : Exposure of sensitive information
Where : From Remote
---------------------------------------------------------------------------



Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~
Application : Esselbach Storyteller CMS System
Version : Esselbach Storyteller CMS System Version 1.8
Vendor : esselbach
Download : http://www.esselbach.com/page5.html
Description :  Storyteller CMS is a powerful Content Management System written in the PHP scripting language and designed for high traffic websites. 
It supports up to 99 websites in the same database and is ready for the next MySQL generation with InnoDB tables.
--------------------------------------------------------------------------



Vulnerability:
~~~~~~~~~~~~
A weakness has been discovered Esselbach Storyteller CMS System.
Where an attacker may execute arbitrary SQL statements on the vulnerable system. 
This may compromise the integrity of your database and/or expose sensitive information.
This vulnerability identified in the path "page.php".


PoC/Exploit:
~~~~~~~~~~
SQL injection vulnerability affects:
http://localhost.com/page.php?id=[Injection Query]

Dork:
~~~~~
Google : powered by Esselbach Storyteller CMS System Version 1.8

Solution:
~~~~~
- Your script should filter metacharacters from user input.
- Edit the source code to ensure that input is properly verified.


Timeline:
~~~~~~~
- 01 - 03 - 2011 bug found
- 02 - 03 - 2011 vendor contacted and response [asked about the detail attack]
- 03 - 03 - 2011 still contacted vendors
- 04 - 03 - 2011 vendors have released patches [http://www.contentteller.com/forums/threads/security-sql-injection-vulnerability-in-storyteller-cms.1148/]
- 09 - 03 - 2011 Advisories release
---------------------------------------------------------------------------



Shoutz:
~~~~~~~
oO0::::: Greetz and Thanks: :::::0Oo.
Tuhan YME
My Parents
SPYRO_KiD
K-159
lirva32
newbie_campuz

And Also My LuvLy wife :
..::.E.Z.R (The deepest Love I'v ever had..).::..

in memorial :
1. Monique
2. Dewi S.
3. W. Devi Amelia
4. S. Anna

oO0:::A hearthy handshake to: :::0Oo
~ Crack SKY Staff
~ Echo staff
~ antijasakom staff
~ jatimcrew staff
~ whitecyber staff
~ lumajangcrew staff
~ devilzc0de staff
~ unix_dbuger, boys_rvn1609, jaqk, byz9991, bius, g4pt3k, anharku, wandi, 5yn_4ck, kiddies, bom2, untouch, antcode
~ arthemist, opt1lc, m_beben, gitulaw, luvrie, poniman_coy, ThePuzci, x-ace, newbie_z, petunia, jomblo.k, hourexs_paloer, cupucyber, kucinghitam, black_samuraixxx, ucrit_penyu, wendys182, cybermuttaqin
~ k3nz0, thomas_ipt2007, blackpaper, nakuragen, candra, dewa
~ whitehat, wenkhairu, Agoes_doubleb, diki, lumajangcrew a.k.a adwisatya a.k.a xyberbreaker, wahyu_antijasakom
~ Cruz3N, mywisdom,flyff666, gunslinger_, ketek, chaer.newbie, petimati, gonzhack, spykit, xtr0nic, N4ck0, assadotcom, Qrembiezs, d4y4x, gendenk, si bD, Jimmy Deadc0de, Rede Deadc0de
~ All people in SMAN 3
~ All members of spyrozone
~ All members of echo
~ All members of newhack
~ All members of jatimcrew
~ All members of Anti-Jasakom
~ All members of whitecyber
~ All members of Devilzc0de
~ All members of Kaskus - "Especially Regional Solo Kaskus"
#e-c-h-o, #K-elektronik, #newhack, #Solohackerlink, #YF, #defacer, #manadocoding, #jatimcrew, #antijasakom, #whitecyber, #devilzc0de
---------------------------------------------------------------------------



Contact:
~~~~~~~~~
Shamus : Shamus@antijasakom.net
Homepage: https://antijasakom.net/forum/viewtopic.php?f=38&t=713
-------------------------------- [ EOF ] ----------------------------------