mailing list archives
cevado technologies real estate CMS SQL injection
From: joseph.giron13 () gmail com
Date: 1 Apr 2008 05:38:13 -0000
I'm back, and I got more.
SQL injection within some real estate CMS software.
The vulnerability is present because of a failure to strip characters from the variables page_id and site_id resulting
in exploitation by some simple blind SQLI.
heres an example:
The number of columns varies slightly, but you can always use good old 'order by' to find that out. The table names
remain the same.
I used the GET'd variable site_d, but page_id works as well.
Cevado.com notified, no patch.
- cevado technologies real estate CMS SQL injection joseph . giron13 (Apr 01)