• Summary
• Description
• PoC/ Exploit
• Solution

Description - SQL Injection and PHP Code Insertion in Pro Publish

Multiple Vulnerabilities found in Pro Publish script.

Exploit

Available

Solution

Not available - check vendor's website

1. SQL Injection.

Vulnerable scripts: admin/login.php cat.php search.php art.php

Parameters email(login.php), password(login.php), find_str(search.php), artid(art.php), catid(cat.php) are not properly sanitized before being used in SQL query. This can be used to bypass authentication or make any SQL query by injecting arbitrary SQL code.

2. PHP code insertion.

An intruder can get login and password of administration area using SQL Injection.

Administrator has an ability to edit some settings. Those values don't pass any sanitation before being saved in set_inc.php script. This can be used to make PHP code insertion.

System access is possible.