SQL Injection Vulnerabilities in ImpressPages CMS

vendor:

ImpressPages CMS

by:

Unknown

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: ImpressPages CMS

Affected Version From: 1.0.4

Affected Version To: 1.0.4

Patch Exists: NO

Related CWE: Not available

CPE: a:impresspages:impresspages:1.0.4

Metasploit:

Other Scripts:

Platforms Tested: Not available

Unknown

SQL Injection Vulnerabilities in ImpressPages CMS

ImpressPages CMS is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Mitigation:

To mitigate these vulnerabilities, it is recommended to sanitize user-supplied data and use prepared statements or parameterized queries to prevent SQL injection attacks.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/40431/info

ImpressPages CMS is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

ImpressPages CMS 1.0.4 is vulnerable; prior versions may also be affected. 

The following example URIs are available:

http://www.example.com/admin.php?module_id=329&security_token=$valid_token&page[0]=&page_size[0]=200+ANY_SQL_HERE+--++

http://www.example.com/admin.php?module_id=329&security_token=$valid_token&sort_field[1]=&email+ANY_SQL_HERE+--+&sort_dir[1]=asc