bugtraq - 1024CMS Blind SQL Injection Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20100302111634.qxbapd0dvz4g0044@mail.amnpardaz.com>
Date: Tue, 02 Mar 2010 11:16:34 +0330
From: admin@...report.ir
To: bugtraq@...urityfocus.com
Subject: 1024CMS Blind SQL Injection Vulnerability

##########################www.BugReport.ir########################################
#
#        AmnPardaz Security Research Team
#
# Title:		1024CMS Blind SQL Injection Vulnerability
# Vendor:		http://www.1024cms.org/
# Vulnerable Version:	2.1.1 (Latest version till now)
# Exploitation:		Remote with browser
# Fix:			N/A
###################################################################################

####################
- Description:
####################

1024CMS is a PHP-based CMS which uses MySQL as its backend DBMS. It  
support forums, downloads,
search capability, BB code capability, gallery, chat and RSS services.


####################
- Vulnerability:
####################

+--> Blind SQL Injection
	The RSS page (rss.php) is vulnerable to SQL injection. The GET  
variable 'id' is
	not sanitized correctly in the SQL query. This hole can be used for  
extracting
	admin password. For details see 'Exploits' section.

####################
- Exploits/PoCs:
####################

http://www.bugreport.ir/69/exploit.htm

####################
- Solution:
####################

Remove rss.php and wait for bug fixation by vendor or escape GET  
parameter in file rss.php using the
vendor string escaping function 'quote_smart' as is used in all of  
other files else of this one.

####################
- Original Advisory:
####################

http://www.bugreport.ir/index_69.htm

####################
- Credit:
####################
AmnPardaz Security Research & Penetration Testing Group
Contact: admin[4t}bugreport{d0t]ir
www.BugReport.ir
www.AmnPardaz.com