39 lines
No EOL
794 B
Text
39 lines
No EOL
794 B
Text
============ { Ariko-Security - Advisory #1/2/2010 } =============
|
|
|
|
SQL injection vulnerability in apemCMS
|
|
|
|
Vendor's Description of Software:
|
|
# http://apem.com.pl/?sc=oferta
|
|
|
|
Dork:
|
|
#Powered by apemCMS
|
|
|
|
Application Info:
|
|
# Name: apemCMS
|
|
# Versions: ALL
|
|
|
|
Vulnerability Info:
|
|
# Type: SQL injection Vulnerability
|
|
# Risk: High
|
|
|
|
Fix:
|
|
# 11.FEB Fixed
|
|
|
|
It was found that apemCMS does not validate properly the "id" parameter
|
|
value.
|
|
|
|
Solution:
|
|
# Input validation of "id" parameter should be corrected.
|
|
|
|
|
|
Vulnerability:
|
|
# http://server/?mod=view_default&id=68[SQLi]
|
|
|
|
Credit:
|
|
# Discoverd By: MG
|
|
# Website: http://Ariko-security.com
|
|
# Contacts: support[-at-]ariko-security.com
|
|
|
|
Ariko-Security
|
|
vuln@ariko-security.com
|
|
tel.: +48512946012 (Mo-Fr 10.00-20.00 CET) |