Cudoma SQL Injection

`# Exploit Title: CUDOMA SQL injection Vulnerability  
# Date: 2011-10-08  
# Author: ANDREA BOCCHETTI  
# Software Link: https://www.cudoma.com/  
# Price: 1.500.00€   
  
Summary: CuDoMa is a Document Management System (DMS),  
a organize, catalog, distribute and manage data and documents.  
The optimal solution for document management companies  
and professional firms that produce large quantities of documents.  
  
Input passed via idtopic parameters are  
not properly sanitised. This can be exploited to manipulate  
SQL queries by injecting arbitrary SQL code.  
  
  
  
  
Time Table   
  
10/10/2011 - Vendor notified  
10/10/2011 - Vendor response.  
11/10/2011 - Vendor provides status update.  
11/10/2011 - Vendor provides status update.  
11/10/2011 - Public disclosure.  
  
======================================================================   
  
  
1)Exploit :  
  
# http://[localhost]/news?idtopic=[SQL]  
  
2) Credits   
  
Discovered by Andrea Bocchetti  
  
3) BUG FIX  
`