SQL Injection and PHP Code Insertion in Pro Publish
- SQL Injection and PHP Code Insertion in Pro Publish
- Last Update
- 2006.05.10 Exploitation code published
- CVE-2006-2128 CVE-2006-2129
- Risk Level
- Multiple Vulnerabilities
- Unpatched. No reply from developer(s)
- Vulnerable Software
- Pro Publish (http://www.deltascripts.com/download/)
- Not available
- Discovered by
- Aliaksandr Hartsuyeu (eVuln.com)
Multiple Vulnerabilities found in Pro Publish (http://www.deltascripts.com/download/) script.
1. SQL Injection.
Vulnerable scripts: admin/login.php cat.php search.php art.php
Parameters email(login.php), password(login.php), find_str(search.php), artid(art.php), catid(cat.php) are not properly sanitized before being used in SQL query. This can be used to bypass authentication or make any SQL query by injecting arbitrary SQL code.
2. PHP code insertion.
An intruder can get login and password of administration area using SQL Injection.
Administrator has an ability to edit some settings. Those values don't pass any sanitation before being saved in set_inc.php script. This can be used to make PHP code insertion.
System access is possible.
1. SQL Injection Example.
URL: http://[host]/cat.php?catid=999 or 1/*
Searchengine: %' or 1/*
2. PHP code insertion example.
Webmaster email: "; [PHP_code] $aaa="
Solution for "SQL Injection and PHP Code Insertion in Pro Publish" is not available. Check vendor's website for updates.