##########################www.BugReport.ir########################################

AmnPardaz Security Research Team

Title: 1024CMS Blind SQL Injection Vulnerability

Vendor: http://www.1024cms.org/

Vulnerable Version: 2.1.1 (Latest version till now)

Exploitation: Remote with browser

Fix: N/A

###################################################################################

####################

• Description:
  ####################

1024CMS is a PHP-based CMS which uses MySQL as its backend DBMS. It
support forums, downloads,
search capability, BB code capability, gallery, chat and RSS services.

####################

• Vulnerability:
  ####################

±-> Blind SQL Injection
The RSS page (rss.php) is vulnerable to SQL injection. The GET
variable 'id' is
not sanitized correctly in the SQL query. This hole can be used for
extracting
admin password. For details see 'Exploits' section.

####################

• Exploits/PoCs:
  ####################

http://www.bugreport.ir/69/exploit.htm

####################

• Solution:
  ####################

Remove rss.php and wait for bug fixation by vendor or escape GET
parameter in file rss.php using the
vendor string escaping function 'quote_smart' as is used in all of
other files else of this one.

####################

• Original Advisory:
  ####################

http://www.bugreport.ir/index_69.htm

####################

• Credit:
  ####################
  AmnPardaz Security Research & Penetration Testing Group
  Contact: admin[4t}bugreport{d0t]ir
  www.BugReport.ir
  www.AmnPardaz.com