Netvolution cms SQL Injection Vulnerability

Release date:
Updated on:

Affected Systems:
Netvolution CMS 3
Description:
--------------------------------------------------------------------------------
Netvolution CMS is a Web content management software.
 
Netvolution CMS 3 and other versions are used in SQL queries if the input sent to some scripts through the "m" parameter is not properly filtered (when "pid" is set to "33 ", "lang" is set to "2"), which can cause arbitrary SQL code injection and SQL query operations.
 
<* Source: projectzero labs

Link: http://secunia.com/advisories/57219/
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:
 
Netvolution CMS
---------------
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:
 
Www.netvolution.net

Http://packetstormsecurity.com/files/125507/Netvolution-WCM-CMS-3-SQL-Inject