← Advisories

u5CMS 3.9.3 Multiple SQL Injection Vulnerabilities

Medium
Advisory ID
ZSL-2015-5225
Release Date
09 February 2015
Vendor
Stefan P. Minder - http://www.yuba.ch
Affected Version
3.9.3 and 3.9.2
CVE
CVE-2015-1576
Tested On
Apache 2.4.10 (Win32), PHP 5.6.3, MySQL 5.6.21
Summary

u5CMS is a little, handy Content Management System for medium-sized websites, conference / congress / submission administration, review processes, personalized serial mails, PayPal payments and online surveys based on PHP and MySQL and Apache.

Description

Input passed via multiple parameters in multiple scripts is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

Proof of Concept
u5cms_sqli.txtTXT
Disclosure Timeline
29.12.2014Vulnerabilities discovered.
04.02.2015Contact with the vendor.
04.02.2015Vendor replies asking more details.
05.02.2015Sent details to the vendor.
06.02.2015Vendor releases version 3.9.4 to address these issues.
09.02.2015Coordinated public security advisory released.
Credits
Vulnerability discovered by Gjoko Krstic
References
[1]http://yuba.ch/index.php?c=u5cms&l=en
[2]http://www.exploit-db.com/exploits/36027
[3]http://cxsecurity.com/issue/WLB-2015020037
[4]http://packetstormsecurity.com/files/130326
[5]http://osvdb.org/show/osvdb/118114
[5]http://osvdb.org/show/osvdb/118113
[6]http://osvdb.org/show/osvdb/118112
[7]http://osvdb.org/show/osvdb/118111
[8]http://osvdb.org/show/osvdb/118110
[9]http://osvdb.org/show/osvdb/118109
[10]http://osvdb.org/show/osvdb/118108
[11]http://osvdb.org/show/osvdb/118105
[12]http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1576
[13]http://cve.mitre.org/cgi-bin/cvename.cgi?name=2015-1576
[14]https://exchange.xforce.ibmcloud.com/#/vulnerabilities/100816
Changelog
09.02.2015Initial release
11.02.2015Added reference [2], [3], [4], [5], [6], [7], [8], [9], [10] and [11]
12.02.2015Added reference [12] and [13]
13.03.2015Added reference [14]