Enano CMS SQL Injection and Information Disclosure Vulnerabilities
BID:45120
Info
Enano CMS SQL Injection and Information Disclosure Vulnerabilities
| Bugtraq ID: | 45120 |
| Class: | Input Validation Error |
| CVE: |
CVE-2010-4780 CVE-2010-4781 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 30 2010 12:00AM |
| Updated: | Apr 13 2015 09:02PM |
| Credit: | High-Tech Bridge SA |
| Vulnerable: |
Enanocms Enano Cms 1.1.7pl1 |
| Not Vulnerable: |
Enanocms Enano Cms 1.1.8 Enanocms Enano Cms 1.1.7pl2 Enanocms Enano Cms 1.0.6pl3 |
Discussion
Enano CMS SQL Injection and Information Disclosure Vulnerabilities
Enano CMS is prone to an SQL-injection vulnerability and an information-disclosure vulnerability.
Exploiting these issues could allow an attacker to obtain sensitive information, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Enano CMS 1.1.7pl1 is vulnerable; other versions may also be affected.
Enano CMS is prone to an SQL-injection vulnerability and an information-disclosure vulnerability.
Exploiting these issues could allow an attacker to obtain sensitive information, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Enano CMS 1.1.7pl1 is vulnerable; other versions may also be affected.
Exploit / POC
Enano CMS SQL Injection and Information Disclosure Vulnerabilities
Attackers can use a browser to exploit these issues.
The following example input and URI are available:
email: "[email protected]'SQL_CODE"
http://www.example.com/index.php?title=Special:Captcha/1
Attackers can use a browser to exploit these issues.
The following example input and URI are available:
email: "[email protected]'SQL_CODE"
http://www.example.com/index.php?title=Special:Captcha/1
Solution / Fix
Enano CMS SQL Injection and Information Disclosure Vulnerabilities
Solution:
Updates are available. Please see the reference for more details.
Solution:
Updates are available. Please see the reference for more details.