apemCMS – SQL Injection

• Exploit Database
• 31 阅读

• 作者： Ariko-Security
  日期： 2010-02-11
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/11411/

• ============ { Ariko-Security - Advisory #1/2/2010 } =============
  
   SQL injection vulnerability in apemCMS 
  
  Vendor's Description of Software:
  # http://apem.com.pl/?sc=oferta
  
  Dork:
  #Powered by apemCMS
  
  Application Info:
  # Name: apemCMS
  # Versions: ALL
  
  Vulnerability Info:
  # Type: SQL injection Vulnerability
  # Risk: High
  
  Fix: 
  # 11.FEB Fixed
  
  It was found that apemCMS does not validate properly the "id" parameter
   value.
  
  Solution:
  # Input validation of "id" parameter should be corrected.
  
  
  Vulnerability:
  # http://server/?mod=view_default&id=68[SQLi]
  
  Credit:
  # Discoverd By: MG
  # Website: http://Ariko-security.com
  # Contacts: support[-at-]ariko-security.com
  
  Ariko-Security
  vuln@ariko-security.com
  tel.: +48512946012 (Mo-Fr 10.00-20.00 CET)