CMSmadesimple-sql.txt

`1) Summary  
  
Affected software CMS Made Simple 1.05  
Vendor URL http://www.cmsmadesimple.org/  
Severity High  
  
2) Vulnerability Description  
  
The affected software is vulnerable to SQL injection via the templateid  
parameter of the stylesheet.php page (the value of this parameter is  
used directly in an SQL query, without any form of escaping or sanitation).  
  
This vulnerability is remotely exploitable, and does not require  
authentication prior to remote exploitation (since the page is normally  
part of the publicly accessible part of the package).  
  
The impact is dependent on the database back-end type (and the subset of  
the SQL language supported by this back-end). E.g. a MySQL 5 back-end  
will allow disclosure of the CMS usernames (including administrators)  
and their password hashes.  
  
3) Verification  
  
http://www.example.com/stylesheet.php?templateid=16+AND+1=1  
http://www.example.com/stylesheet.php?templateid=16+AND+1=0  
  
4) Solution  
  
Update to version 1.06 of the affected software.  
  
5) Time Table  
  
2007/04/24 Vendor was informed  
2007/04/24 Vendor releases version 1.06 which fixes the issue  
2007/05/02 Scanit publishes advisory  
  
6) Additional Information  
  
The original advisory can be found here:  
http://www.scanit.be/advisory-2007-05-02.html  
  
7) About Scanit  
  
Scanit is a security company located in Brussels, Belgium. We specialise  
in security assessments, offering services such as penetration tests,  
application source code reviews, and risk assessments. More information  
can be found at http://www.scanit.be/.  
  
`