724CMS 5.01 / 4.59 / 4.01 / 3.01 SQL Injection

2015-03-17T00:00:00
ID PACKETSTORM:130855
Type packetstorm
Reporter Wang Jing
Modified 2015-03-17T00:00:00

Description

                                        
                                            `*724CMS 5.01 Multiple SQL Injection Security Vulnerabilities*  
  
  
Exploit Title: 724CMS Multiple SQL Injection Security Vulnerabilities  
Vendor: 724CMS  
Product: 724CMS  
Vulnerable Versions: 3.01 4.01 4.59 5.01  
Tested Version: 5.01  
Advisory Publication: March 14, 2015  
Latest Update: March 14, 2015  
Vulnerability Type: Improper Neutralization of Special Elements used in an  
SQL Command ('SQL Injection') [CWE-89]  
CVE Reference: *  
Impact CVSS Severity (version 2.0):  
CVSS v2 Base Score: 7.5 (HIGH) (AV:N/AC:L/Au:N/C:P/I:P/A:P) (legend)  
Impact Subscore: 6.4  
Exploitability Subscore: 10.0  
Credit: Wang Jing [Mathematics, Nanyang Technological University (NTU),  
Singapore]  
  
  
  
  
  
  
  
*Recommendation Details:*  
  
  
*(1) Vendor & Product Description:*  
  
  
*Vendor:*  
724CMS Enterprise  
  
  
  
*Product & Vulnerable Versions:*  
724CMS  
3.01  
4.01  
4.59  
5.01  
  
  
  
  
  
*Vendor URL & download:*  
724CMS can be gain from here,  
http://724cms.com/  
  
  
  
*Product Introduction Overview:*  
"724CMS is a content management system (CMS) that has customers spread in  
Canada, Japan, Korean, the United States, European and many others. It  
allows publishing, editing and modifying content, organizing, deleting as  
well as maintenance from a central interface. Meanwhile, 724CMS provides  
procedures to manage workflow in a collaborative environment."  
  
"A CMS helps you create and store content in a shared repository. It then  
manages the relationships between content items for you (e.g. keeping track  
of where they fit into the site hierarchy). Finally, it ensures that each  
content item is connected to the right style sheet when it comes to be  
published. Some CMSs also provide facilities to track the status of content  
items through editorial processes and workflows."  
  
  
  
  
  
  
*(2) Vulnerability Details:*  
724CMS web application has a security bug problem. It can be exploited by  
SQL Injection attacks. This may allow an attacker to inject or manipulate  
SQL queries in the back-end database, allowing for the manipulation or  
disclosure of arbitrary data.  
  
Several 724CMS products vulnerabilities have been found by some other bug  
hunter researchers before. 724CMS has patched some of them. The MITRE  
Corporation is a not-for-profit company that operates multiple federally  
funded research and development centers (FFRDCs), which provide innovative,  
practical solutions for some of our nation's most critical challenges in  
defense and intelligence, aviation, civil systems, homeland security, the  
judiciary, healthcare, and cybersecurity. It has phase, votes, comments and  
proposed details related to 724CMS vulnerabilities.  
  
  
*(2.1)* The first cipher programming flaw occurs at "/index.php" page with  
"&Lang", "&ID" parameters.  
  
*(2.2) *The second cipher programming flaw occurs at "/section.php" page  
with "&Lang", "&ID" parameters.  
  
  
  
  
  
  
  
  
*References:*  
http://www.tetraph.com/security/sql-injection-vulnerability/724cms-5-01-multiple-sql-injection-security-vulnerabilities/  
http://securityrelated.blogspot.com/2015/03/724cms-501-multiple-sql-injection.html  
http://www.inzeed.com/kaleidoscope/computer-web-security/724cms-5-01-multiple-sql-injection-security-vulnerabilities/  
http://diebiyi.com/articles/%E5%AE%89%E5%85%A8/724cms-5-01-multiple-sql-injection-security-vulnerabilities/  
https://computertechhut.wordpress.com/2015/03/14/724cms-5-01-multiple-sql-injection-security-vulnerabilities/  
https://www.mail-archive.com/fulldisclosure%40seclists.org/msg01766.html  
http://marc.info/?a=139222176300014&r=1&w=4  
http://en.1337day.com/exploit/23308  
  
  
  
  
  
  
--  
Wang Jing,  
Division of Mathematical Sciences (MAS),  
School of Physical and Mathematical Sciences (SPMS),  
Nanyang Technological University (NTU),  
Singapore.  
http://www.tetraph.com/wangjing/  
https://twitter.com/tetraphibious  
  
  
`