InstantCMS 1.10.3盲注

产品: InstantCMSVendor: InstantSoft影响版本1.10.3 及之前版本已测试版本: 1.10.3缺陷类型: SQL Injection [CWE-89]解决方案: 官方已修复Discovered and Provided: High-Tech Bridge Security Research Lab ( https://www.htbridge.com/advisory/ )  ----------------------------------------------------------------------------------------------- Advisory Details: High-Tech Bridge Security Research Lab discovered blind SQL injection vulnerability in InstantCMS, which can be exploited to perform SQL Injection attacks, alter SQL requests and compromise vulnerable application.   1) SQL Injection in InstantCMS: CVE-2013-6839 The vulnerability exists due to insufficient filtration of "orderby" HTTP POST parameter passed to "/catalog/[id]" URL. A remote unauthenticated attacker can execute arbitrary SQL commands in application's database. Simple exploit code below uses blind SQL injection exploitation technique, and will display different order of records on the page if MySQL version is 5.*:  <form action="http://[host]/catalog/2" method="post" name="main"><input type="hidden" name="orderby"  value="(-pubdate*(substring(version(),1,1)=5))"><input type="hidden" name="orderto"  value="asc"><input type="submit" id="btn"></form>  解决方案: Apply patch for InstantCMS 1.10.3:http://www.instantcms.ru/download/patch/security_update_for_iCMS_1.10.3_21-11-2013.zip InstantCMS 1.10.3 downloaded after 21/11/2013 is patched [without version/release modification] and is not vulnerable. More Information:http://www.instantcms.ru/novosti/security-update-1-10-3.htmlhttp://trac.instantcms.ru/changeset/1376