Entry Level CMS 'index.php' SQL Injection Vulnerability
BID:38422
Info
Entry Level CMS 'index.php' SQL Injection Vulnerability
| Bugtraq ID: | 38422 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 25 2010 12:00AM |
| Updated: | Jun 10 2010 07:09PM |
| Credit: | HaMaDa SCoOoRPioN |
| Vulnerable: |
Entry Level CMS Entry Level CMS 0 |
| Not Vulnerable: | |
Discussion
Entry Level CMS 'index.php' SQL Injection Vulnerability
Entry Level CMS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Entry Level CMS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Exploit / POC
Entry Level CMS 'index.php' SQL Injection Vulnerability
Attackers can use a browser to exploit this issue.
The following example URI is available:
http://www.example.com/index.php?subj=6+AND+1=2+UNION+SELECT+0,1,2,3--
Attackers can use a browser to exploit this issue.
The following example URI is available:
http://www.example.com/index.php?subj=6+AND+1=2+UNION+SELECT+0,1,2,3--
Solution / Fix
Entry Level CMS 'index.php' SQL Injection Vulnerability
Solution:
The vendor released an update to address this issue. Please contact the vendor for information on how to obtain and apply this update.
Solution:
The vendor released an update to address this issue. Please contact the vendor for information on how to obtain and apply this update.
References
Entry Level CMS 'index.php' SQL Injection Vulnerability
References:
References:
- Entry Level CMS Homepage (Entry Level CMS)