Boomerank CMS WebShop-module SQL Injection

# Exploit Title: Boomerank CMS WebShop-module SQL Injection Vuln.
# Date: 28.03.2012
# Google Dork: inurl:"vozicek-dodaj.html?id=" site:.si 
# Author: Mr.5p0ng3 [[email protected]]
# Software Link: www.boomerank.net (Author's website)
# Version: All
# Tested on: Linux
# Running on: Apache 2.2.3

#[0x1] - About

 Boomerank is a CMS which can also be used for webstore because it is highly modular by design. 
It is also compatible or specially designed for use with DataLab Pantheon Information System.
 
#[0x2] - Vulnerability

I have identified 3 SQLi vulnerabilities. 2 are inconclusive since they don't affect every setup or project in same manner.
In some cases the variable is sanitized in some not!
Therefore I will not go into details with those particular vulnerabilities.

Vulnerability 1:

WebShop module has a function that allows adding item to shopping cart.(icon "V voziček")

http://someurl/vozicek-dodaj.html?id=1' + [SQLi] 

#[0x3] - Live website examples

http://www.pigo.si/vozicek-dodaj.html?id=[SQLi]
http://www.naredisisam.si/vozicek-dodaj.html?id=[SQLi]
www.vedaena.si/vozicek-dodaj.html?id=[SQLi]
....

#[0x4] - Notes

Nothing to say...

#[0x5] - Greetz n shit ###################################################
# Special thanks and greetz goes to 1337day Inj3ct0r team and staff.     #
# .......................................................................#
# How about a theme song now?Here it goes...Bounce bounce bounce!!       #
# Ooooohhhhhhhhhhhh, who lives in the code just under hardware?          #
# mr5p0ng3 bob hacker pants!!!!!!                                        #
# .......................................................................#                                                                        
##########################################################################
//Mr.5p0ng3//[email protected]//



#  0day.today [2018-02-20]  #