apemCMS – SQL Injection
============ { Ariko-Security - Advisory #1/2/2010 } ============= SQL injection vulnerability in apemCMS Vendor's Description of Software: # http://apem.com.pl/?sc=oferta Dork: #Powered by apemCMS Application Info: # Name: apemCMS # Versions: ALL Vulnerability Info: # Type: SQL injection Vulnerability # Risk: High Fix: # 11.FEB Fixed It was found that apemCMS does not validate properly the "id" parameter value. Solution: # Input validation of "id" parameter should be corrected. Vulnerability: # http://server/?mod=view_default&id=68[SQLi] Credit: # Discoverd By: MG # Website: http://Ariko-security.com # Contacts: support[-at-]ariko-security.com Ariko-Security vuln@ariko-security.com tel.: +48512946012 (Mo-Fr 10.00-20.00 CET) |