[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Full-disclosure] SQL Injection vulnerability in Soltech.CMS
- To: <submissions@xxxxxxxxxxxxxxxxxxxxxxx>, <full-disclosure@xxxxxxxxxxxxxxxxx>, "1337 Exploit DataBase" <mr.inj3ct0r@xxxxxxxxx>
- Subject: [Full-disclosure] SQL Injection vulnerability in Soltech.CMS
- From: "MustLive" <mustlive@xxxxxxxxxxxxxxxxxx>
- Date: Wed, 14 Aug 2013 19:53:15 +0300
Hello list!
There is SQL Injection vulnerability in Soltech.CMS. This is commercial CMS.
-------------------------
Affected products:
-------------------------
Vulnerable are Soltech.CMS v 0.4 and previous versions.
-------------------------
Affected vendors:
-------------------------
Soltech
http://soltech.com.ua
----------
Details:
----------
SQL Injection (WASC-19):
http://site/index.php?level_path=%27%20or%20version()=5%23
------------
Timeline:
------------
2013.06.05 - announced at my site.
2013.06.07 - informed developers about the first part of vulnerabilities.
2013.07.14 - informed developers about the second part of vulnerabilities.
2013.08.13 - disclosed at my site (http://websecurity.com.ua/6550/).
Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/