lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <05be7454-da8b-b0a5-21f8-470684a0ad2a@gmail.com> Date: Wed, 17 Mar 2021 12:49:15 +0100 From: riccardo krauter <riccardo.krauter@...il.com> To: fulldisclosure@...lists.org Subject: [FD] CMS Made Simple SQL injection on m1_sortby parameter 1) Summary Affected software CMS Made Simple-2.2.15 Vendor URLhttp://www.cmsmadesimple.org/ <http://www.cmsmadesimple.org/> Vulnerability SQL injection 2) Vulnerability Description The affected software is vulnerable to SQL injection via the m1_sortby POST parameter of the News module, reachable via the moduleinterface.php page. The `sortby` parameter is sanitized by replacing the `'` with the `_` character, anyway it is possible to inject arbitrary SQL language without using the `'`. This vulnerability is remotely exploitable and require authentication. 3) PoC and details https://github.com/beerpwn/CVE/blob/master/cms_made_simple_2021/sqli_order_by/CMS-MS-SQLi-report.md 4) Credits This vulnerability has been discovered and reported by Riccardo Krauter researcher @ Soter IT Security (soteritsecurity.com). 5) Timeline 2021/02/22 Vendor was informed 2021/02/26 Vendor said he won't fix 2021/03/17 Public disclosure _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
Powered by blists - more mailing lists