Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security Bugtraq
[Top] [All Lists]

SQL-injections in koobi-cms

Subject: SQL-injections in koobi-cms
Date: 27 Apr 2005 20:25:18 -0000


 SQL-injections in koobi-cms 4.2.3 
_____________________________________________________________ 
The program: koobi-cms 
Homepage: http://www.dream4.de/ 
Vulnerable Versions: 4.2.3 
Has found: CENSORED [SVT] 28.04.05 
_____________________________________________________________ 


The description 
--------------- 

Vulnerability has been found in parameter page. In koobi-cms it 
Refers to - p. Data transferred to this parameter not 
Are filtered. Owing to it it is possible to make SQL-injections. 
As at substitution of a symbol ', probably to define 
House dir a server. 

Still the mistake exists in parameter q. It is used for 
Search on a site.

Examples 
--------

http://127.0.0.1/index.php?p='[SQL code] 
http://127.0.0.1/index.php?area=1&p='[SQL code] 
http://127.0.0.1/index.php?q='[SQL code] 


The conclusion 
-------------- 

Vulnerability is found out in version 4.2.3, on other versions 
Research did not spend. Probably they too are vulnerable. 
------------------------------------------------------------- 

CENSORED  Search Vulnerabilities Team 
www.security-tmp.net.ru 

<Prev in Thread] Current Thread [Next in Thread>
  • SQL-injections in koobi-cms, CENSORED <=