EZCMS - exploit.company

vendor:

EZCMS

by:

t0pP8uZz

7.5

CVSS

HIGH

Blind SQL Injection & Arbitrary Remote File Manager Access

CWE

Product Name: EZCMS

Affected Version From: All versions prior to date

Affected Version To: All versions prior to date

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

EZCMS <= 1.2 Multiple Remote Vulnerabilitys

EZCMS (all versions prior to date) suffers from 2 remote vulnerabilitys. One of these being a BLIND Sql Injection in 'index.php' and the 'page' variable is injectable. The second one being a insecure filemanager, the filemanager is hidden away in admin, the devs probarly thought no one would find it. The Blind SQL Injection can be tested by using http://site.com/index.php?page=1 and 1=1 and http://site.com/index.php?page=1 and 1=2. The Arbitrary Remote File Manager Access can be accessed by using http://site.com/ezcms/admin/filemanager/.

Mitigation:

The Blind SQL Injection can be tested by using http://site.com/index.php?page=1 and 1=1 and http://site.com/index.php?page=1 and 1=2. The Arbitrary Remote File Manager Access can be accessed by using http://site.com/ezcms/admin/filemanager/.

Source

Exploit-DB raw data:

-[*]+================================================================================+[*]-
-[*]+		       EZCMS <= 1.2 Multiple Remote Vulnerabilitys	             +[*]-
-[*]+================================================================================+[*]-



[*] Discovered By: t0pP8uZz
[*] Discovered On: 19 MAY 2008
[*] Script Download: http://eztechhelp.com
[*] DORK google/altavista: "Powered by EZCMS"



[*] Vendor Has Not Been Notified!



[*] DESCRIPTION: 

	EZCMS (all versions prior to date) suffers from 2 remote vulnerabilitys.
	
	One of these being a BLIND Sql Injection in "index.php" and the "page" variable is injectable.
	see example below.

	The second one being a insecure filemanager, the filemanager is hidden away in admin, the devs
	probarly thought no one would find it.. but here i am telling you  ;)  
	see more below.



[*] Blind SQL Injection:

	http://site.com/index.php?page=1 and 1=1
	http://site.com/index.php?page=1 and 1=2



[*] Arbitrary Remote File Manager Access:

	http://site.com/ezcms/admin/filemanager/



[*] NOTE/TIP: 

	no exploit coded for the blind injection, because no point due to you can get a easy shell
	through the file manager, althou if your curious, use SQLMap. (check sourceforge)

	the "File Manager" is a very easy to use bug, just browse to site.com/ezcms/admin/filemanager/
	site.com being the actual site and you can upload/edit/delete/upload/move  files/folders.



[*] GREETZ: 

	milw0rm.com, h4ck-y0u.org, CipherCrew !



[-] peace, 

	t0pP8uZz



-[*]+================================================================================+[*]-
-[*]+		       EZCMS <= 1.2 Multiple Remote Vulnerabilitys	             +[*]-
-[*]+================================================================================+[*]-

# milw0rm.com [2008-06-14]