Speck CMS SQL Injection

`Author: Jason Whelan  
PacketStorm: exploitdev  
Email: [email protected]  
  
Target Software: Speck CMS Framework, Latest  
Vendor URL: http://www.speckcms.org/  
  
Multiple SQL Injection Vulnerabilities  
  
Examples:  
  
portal/user.cfm:  
<cfquery name="qUser" datasource="#request.speck.codb#">  
SELECT * FROM spUsers WHERE username = '#url.username#'  
</cfquery>  
  
portal/group.cfm:  
<cfquery name="qGroup" datasource="#request.speck.codb#">  
SELECT * FROM spGroups WHERE groupname = '#url.groupname#'  
</cfquery>  
  
  
Many more exist in this CMS framework. Exploitation will depend on the use  
of these files within the user's CMS.  
`