Campaign Enterprise 11.0.421 SQLi Vulnerability

[+] Post Title :

Campaign Enterprise 11.0.421 SQLi Vulnerability

[+] Date : Rabu, 01 Februari 2012
[+] Author : Dr. Cruzz
[+] Link : http://xcruzz.blogspot.com/2012/02/campaign-enterprise-110421-sqli.html
[+] Type : Exploit

EDB-ID : 18430    CVE: N/A    OSVDB-ID: N/A
Author : Craig Freyman    Published: 2012-01-30    Verified: Not Verified
Exploit Code :   Download    Vulnerable App:   N/A

########################################################################################

#Exploit Title: Campaign Enterprise 11.0.421 SQLi Vulnerability

#Author: Craig Freyman (@cd1zz)

#Date Discovered: 12/12/2011

#Vendor Site: http://www.arialsoftware.com

#Vendor Notified: 1/19/2012

#Vendor Fixed: 1/30/2012 (Version 11.0.512)

#Description: The SID parameter in a POST is vulnerable to a boolean based blind SQLi.

#You must be authenticated to access this parameter. The default database for Campaign

#Enterprise is MS Access.

########################################################################################

#Proof of Concept

#

POST /Command HTTP/1.1

SID=303[SQLi]&ACTION=ADMINISTRATION&ALTCOMMAND=REFRESH&CAMPAIGNID=3&SortBy=CampaignName&LISTVALUE=&CampaignName=&CopyCampaignName=&PageNumber=Page+1&SearchText=