full-disclosure - Re: Pogodny CMS Vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20100216192616.71a37c89@foo.fgeek.fi>
Date: Tue, 16 Feb 2010 19:26:16 +0200
From: Henri Salo <henri@...v.fi>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: Pogodny CMS Vulnerabilities

On Tue, 16 Feb 2010 11:04:47 +0100
Maciej Gojny <vuln@...ko-security.com> wrote:

> # Exploit Title: [Pogodny CMS SQL injection]
> # Date: [08.02.2010]
> # Author: [Ariko-Security]
> # Software Link: [http://www.cms.michalin.pl/moduly/pogodny/]
> # Version: [ALL]
> # Tested on: [freebsd / ubuntu]
> 
> ============ { Ariko-Security - Advisory #2/2/2010 } =============
> 
>       SQL injection vulnerability in Pogodny CMS
> 
> 
> Vendor's Description of Software:
> # http://www.cms.michalin.pl/moduly/pogodny/  (PL)
> # vendor's DEMO http://www.cms.kr.media.pl/
> 
> Dork:
> #pogodny CMS
> 
> Application Info:
> # Name: pogodny CMS
> # Versions: ALL
> 
> Vulnerability Info:
> # Type: SQL injection Vulnerability
> # Risk: High
> 
> Fix: 
> # N/A Vendor notified 08.02.2010
> 
> It was found that "pogodny CMS" does not validate properly the "id"
> parameter value.
> 
> Solution:
> # Input validation of "id" parameter should be corrected.
> 
> 
> Vulnerability:
> # http://[HOST]/?modul=niusy&id=61[Sqli]
> 
> Credit:
> # Discoverd By: MG
> # Website: http://Ariko-security.com
> 
> Ariko-Security
> vuln@...ko-security.com
> tel.: +48512946012 (Mo-Fr 10.00-20.00 CET)

Is there a CVE assigned for this issue?

---
Henri Salo

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/