Pragyan CMS 3.0 – SQL Injection

• Exploit Database
• 18 阅读

• 作者： Steffen Rösemann
  日期： 2015-02-04
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/35991/

• Advisory: SQL injection vulnerability in Pragyan CMS v.3.0
  Advisory ID: SROEADV-2015-11
  Author: Steffen Rösemann
  Affected Software: Pragyan CMS v.3
  Vendor URL: https://github.com/delta/pragyan, http://delta.nitt.edu/
  Vendor Status: vendor did not respond after initial communication
  CVE-ID: -
  
  ==========================
  Vulnerability Description:
  ==========================
  
  Pragyan CMS v. 3 suffers from a SQL injection vulnerability that can be
  abused even by unauthenticated attackers.
  
  ==================
  Technical Details:
  ==================
  
  The user-profile of registered users of Pragyan CMS v.3 is vulnerable to
  SQL injection attacks. A user-profile can be found in the following
  location of a common Pragyan CMS installation:
  
  http://{TARGET}/user:1
  
  Exploit-Example:
  
  http://
  {TARGET}/user:1%27+and+1=2+union+select+database%28%29,version%28%29,3+--+
  
  
  
  =========
  Solution:
  =========
  
  Vendor notified, did not respond after initial communication.
  
  If you use Pragyan CMS v.3, please locate the file userprofile.lib.php and
  use my patch (see [5], usage at your own risk!).
  
  
  
  
  ====================
  Disclosure Timeline:
  ====================
  18-Jan-2015 – found the vulnerability
  19-Jan-2015 - informed the developers (see [3])
  19-Jan-2015 – release date of this security advisory [without technical
  details]
  19-Jan-2015 - forked the project to keep it available/researchable in its
  current state for other researchers [4]
  03-Feb-2015 - release date of this security advisory
  03-Feb-2015 - provided a patch for vulnerability (see [5])
  03-Feb-2015 - send to FullDisclosure
  
  
  
  ========
  Credits:
  ========
  
  Vulnerability found and advisory written by Steffen Rösemann.
  
  ===========
  References:
  ===========
  
  [1] http://delta.nitt.edu/ / https://github.com/delta/pragyan
  [2] http://sroesemann.blogspot.de/2015/01/sroeadv-2015-11.html
  [3] https://github.com/delta/pragyan/issues/206
  [4] https://github.com/sroesemann/pragyan
  [5] http://pastebin.com/ip2gGYuS