Pogodny CMS – SQL Injection
# Exploit Title: [Pogodny CMS SQL injection] # Tested on: [freebsd / ubuntu] ============ { Ariko-Security - Advisory #2/2/2010 } ============= SQL injection vulnerability in Pogodny CMS Vendor's Description of Software: # http://www.cms.michalin.pl/moduly/pogodny/ (PL) Dork: #pogodny CMS Application Info: # Name: pogodny CMS # Versions: ALL Vulnerability Info: # Type: SQL injection Vulnerability # Risk: High Fix: # N/A Vendor notified 08.02.2010 It was found that "pogodny CMS" does not validate properly the "id" parameter value. Solution: # Input validation of "id" parameter should be corrected. Vulnerability: # http://server/?modul=niusy&id=61[Sqli] Credit: # Discoverd By: MG # Website: http://Ariko-security.com # Contacts: support[-at-]ariko-security.com Ariko-Security vuln@ariko-security.com tel.: +48512946012 (Mo-Fr 10.00-20.00 CET) |