PostNuke ContentExpress Module Blind Sql Injection

[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]

# Title : PostNuke ContentExpress Module Blind Sql Injection
# Published : 2010-03-17
# Author : Ali Abbasi
# Previous Title : Preisschlacht Multi Liveshop System SQL Injection (seite&aid) index.php
# Next Title : Joomla Component com_ckforms Multiple Vulnerabilities

# Date: 17/03/2010
# Software Link: http://sourceforge.net/projects/pn-formexpress/
# Version: 0.3.2
####################################################################
PostNuke ContentExpress Module Blind Sql Injection
Reported by Sharif University of Technology CSIRT
Vulnerability Analysis and Penetration Testing Group
cert.sharif.edu , nsc.sharif.edu
####################################################################

===[ POC ]===
Vulnerability occurred in form_id parameter of FormExpress Component in Postnuke
/index.php?module=FormExpress&func=display_form&form_id=1'
The Attacker could read content of the database via blind sql injection methods (like ascii(substring))
####################################################################

-----
Ali Abbasi