[-][-][-][-][-][-][-][-][-][-][-][-][-][-][-][-][-][-][-][-][-][-][-][-]

Exploit Title  : Newsletter 4.3 SQL Injection Vulnerability

Exploit Author : Ashiyane Digital Security Team

Vendor Homepage: www.conpresso.de - www.conpresso4.de

Google Dork ONE: intext:Module Newsletter 4.3

Google Dork TWO: Module Newsletter 4.3 by www.conpresso4.de

Date           : 2015-05-21

Tested On      : linux Kali + Windows Se7en

Link Software  : http://www.conpresso4.de/_data/cpo4_mod_newsletter_4.3e.zip

[-][-][-][-][-][-][-][-][-][-] DESCRITION [-][-][-][-][-][-][-][-][-][-]

newsletter Module SQL Injection Vulnerability
Researched by  Ashiyane Security Researcher Team

[-][-][-][-][-][-][-][-][-][-] Location [-][-][-][-][-][-][-][-][-][-][-]

http://localhost/[patch]/mod_newsletter/preview.php?action=preview&nr=( SQL )

[-][-][-][-][-][-][-][-][-] Vulnerability CODE [-][-][-][-][-][-][-][-][-]

======= includes/inc_preview.inc.php ========

<?php
if (!defined('CPO')) exit;

if (!is_numeric($_GET['nr'])) exit;

$query = "SELECT commentary, verfallsdatum, templates_id, nr, idx,  
email, autor, pub_datum, titel, initial, freigabe "
         ."FROM ".CPO_NEWS." "
         ."WHERE nr=".(int)$_GET['nr']." ";

DEBUG(2, $query, __FILE__, __LINE__);
$db = new DB;
$db->query($query);

$db->next_record();
$db_template      = $db->v('templates_id');
$db_nr            = $db->v('nr');
$db_idx           = $db->v('idx');
$db_email         = $db->v('email');
$db_autor         = $db->v('autor');
$db_pub_datum     = $db->v('pub_datum');
$db_verfallsdatum = $db->v('verfallsdatum');
$db_commentary    = $db->v('commentary');
$db_titel         = $db->v('titel');
$db_initial       = $db->v('initial');
$db_freigabe      = $db->v('freigabe');

$pagetype = 'detail';
require(CPO_BASEDIR.$activeModules[$directory]['directory'].'/includes/inc_output.inc.php');
?>

[-][-][-][-][-][-][-][-][-][-][-][-][-][-][-][-][-][-][-][-][-][-][-][-]

           Discovered by : SeRaVo.BlackHat  >> H.4.S.S.4.N <<

Special Tnx : Hamed Nikpour - Hesam Bazvand - H_SQLI.EMpiRe - Rezahck23

Mohammad habili - Alireza Akhtari - Und3rgr0und - EviL ShaDoW - ACCESS

[-][-][-][-][-][-][-][-][-][-][-][-][-][-][-][-][-][-][-][-][-][-][-][-]