full-disclosure-uk May 2007 archive
Main Archive Page > Month Archives  > full-disclosure-uk archives
full-disclosure-uk: [Full-disclosure] CMS Made Simple: SQL injec

[Full-disclosure] CMS Made Simple: SQL injection

From: Daniel Lucq <daniel_at_nospam>
Date: Wed May 02 2007 - 09:02:03 GMT
To: full-disclosure@lists.grok.org.uk

  1. Summary

Affected software CMS Made Simple 1.05 Vendor URL http://www.cmsmadesimple.org/ Severity High

2) Vulnerability Description

The affected software is vulnerable to SQL injection via the templateid parameter of the stylesheet.php page (the value of this parameter is used directly in an SQL query, without any form of escaping or sanitation).

This vulnerability is remotely exploitable, and does not require authentication prior to remote exploitation (since the page is normally part of the publicly accessible part of the package).

The impact is dependent on the database back-end type (and the subset of the SQL language supported by this back-end). E.g. a MySQL 5 back-end will allow disclosure of the CMS usernames (including administrators) and their password hashes.

3) Verification

http://www.example.com/stylesheet.php?templateid=16+AND+1=1 http://www.example.com/stylesheet.php?templateid=16+AND+1=0

4) Solution

Update to version 1.06 of the affected software.

5) Time Table 2007/04/24 Vendor was informed 2007/04/24 Vendor releases version 1.06 which fixes the issue 2007/05/02 Scanit publishes advisory

6) Additional Information

The original advisory can be found here: http://www.scanit.be/advisory-2007-05-02.html

7) About Scanit

Scanit is a security company located in Brussels, Belgium. We specialise in security assessments, offering services such as penetration tests, application source code reviews, and risk assessments. More information can be found at http://www.scanit.be/.

Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/