[prev in list] [next in list] [prev in thread] [next in thread]
List: full-disclosure
Subject: [FD] CMS Made Simple SQL injection on m1_sortby parameter
From: riccardo krauter <riccardo.krauter () gmail ! com>
Date: 2021-03-17 11:49:15
Message-ID: 05be7454-da8b-b0a5-21f8-470684a0ad2a () gmail ! com
[Download RAW message or body]
1) Summary
Affected software CMS Made Simple-2.2.15
Vendor URLhttp://www.cmsmadesimple.org/ <http://www.cmsmadesimple.org/>
Vulnerability SQL injection
2) Vulnerability Description
The affected software is vulnerable to SQL injection via the m1_sortby POST parameter of the \
News module, reachable via the moduleinterface.php page. The `sortby` parameter is sanitized by \
replacing the `'` with the `_` character, anyway it is possible to inject arbitrary SQL \
language without using the `'`. This vulnerability is remotely exploitable and require \
authentication.
3) PoC and details
https://github.com/beerpwn/CVE/blob/master/cms_made_simple_2021/sqli_order_by/CMS-MS-SQLi-report.md
4) Credits
This vulnerability has been discovered and reported
by Riccardo Krauter researcher @ Soter IT Security (soteritsecurity.com).
5) Timeline
2021/02/22 Vendor was informed
2021/02/26 Vendor said he won't fix
2021/03/17 Public disclosure
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic