Advertisement






1024 CMS 2.1.1 remote blind SQL injection vulnerability

CVE Category Price Severity
N/A CWE-89 $5000 High
Author Risk Exploitation Type Date
Unknown High Remote 2010-03-09
CPE
cpe:cpe:/a:cms:cms:2.1.1
CVSS EPSS EPSSP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N 0.02192 0.50148

CVSS vector description

Our sensors found this exploit at: http://cxsecurity.com/ascii/WLB-2010030012

Below is a copy:

##########################www.BugReport.ir########################################
#
#        AmnPardaz Security Research Team
#
# Title:1024CMS Blind SQL Injection Vulnerability
# Vendor:http://www.1024cms.org/
# Vulnerable Version:2.1.1 (Latest version till now)
# Exploitation:Remote with browser
# Fix:N/A
######################

####################
- Description:
####################

1024CMS is a PHP-based CMS which uses MySQL as its backend DBMS. It  
support forums, downloads,
search capability, BB code capability, gallery, chat and RSS services.


####################
- Vulnerability:
####################

+--> Blind SQL Injection
The RSS page (rss.php) is vulnerable to SQL injection. The GET  
variable 'id' is
not sanitized correctly in the SQL query. This hole can be used for  
extracting
admin password. For details see 'Exploits' section.

####################
- Exploits/PoCs:
####################

http://www.bugreport.ir/69/exploit.htm

####################
- Solution:
####################

Remove rss.php and wait for bug fixation by vendor or escape GET  
parameter in file rss.php using the
vendor string escaping function 'quote_smart' as is used in all of  
other files else of this one.

####################
- Original Advisory:
####################

http://www.bugreport.ir/index_69.htm

####################
- Credit:
####################
AmnPardaz Security Research & Penetration Testing Group
Contact: admin[4t}bugreport{d0t]ir
www.BugReport.ir
www.AmnPardaz.com


Copyright ©2024 Exploitalert.

All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use.