ApemCMS SQL Injection Vulnerability

==========={ Ariko-Security-Advisory #1/2/2010 }============

SQL injection vulnerability in apemCMS

Vendors Description of Software:
# Http://apem.com.pl /? SC = oferta

Dork:
# Powered by apemCMS

Application Info:
# Name: apemCMS
# Versions: ALL

Vulnerability Info:
# Type: SQL injection Vulnerability
# Risk: High

Fix:
# 11.FEB Fixed

It was found that apemCMS does not validate properly the "id" parameter
Value.

Solution:
# Input validation of "id" parameter shocould be corrected.

Vulnerability:
# Http: // server /? Mod = view_default & id = 68 [SQLi]

Credit:
# Discoverd By: MG
# Website: http://Ariko-security.com
# Contacts: support [-at-] ariko-security.com

Ariko-Security
Vuln@ariko-security.com
Tel.: + 48512946012 (Mo-Fr 10.00-20.00 CE