XAOS CMS SQL Injection Vulnerability

vendor:

XAOS CMS

by:

H-SK33PY

8,8

CVSS

HIGH

SQL Injection

CWE

Product Name: XAOS CMS

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: N/A

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Linux

2010

XAOS CMS SQL Injection Vulnerability

After finding a bug on the sites, an attacker can run an SQL injection by appending 'SQLi' to the URL, or a Blind SQL injection by appending 'BSQLi' to the URL.

Mitigation:

Input validation and sanitization should be used to prevent SQL injection attacks.

Source

Exploit-DB raw data:

# Exploit Title: XAOS CMS SQL Injection Vulnerability            
# Date: 25/07/2010                             
# Author: H-SK33PY                      
# Software Link: http://www.xaos.it/
# Version: N/A
# Google dork : Powered by XAOS systems
# Platform / Tested on: linux
# Category: webapplications
# Code : [SQLi] & [BSQLi]


   010101010101010101010101010101010101010101010101010101010    
   0                                                       0
   1  Iranian Datacoders Security Team 2010
   0                                                       0
   010101010101010101010101010101010101010101010101010101010

#BUG:#########################################################################

After find bug on the sites , run this :

http://site.com/index.php?m=1[SQLi]

If you can not inject run Blind SQL Injection

http://site.com/index.php?m=1[BSQLi]



#############################################################################
Website : http://www.datacoders.ir

Special Thanks to : ccC0d3rZzz & all iranian datacoders members

#############################################################################