search

taogogo / taocms

taoCMS is an incredible tiny CMS( Content Management System) , writen in PHP and support MySQL/Sqlite as the database(MIT License)
MIT License
60 stars 21 forks source link

There is SQL blind injection at "Article search"(Column administrator authority) #5

Closed ddddbhm closed 3 years ago

ddddbhm commented 3 years ago

First, we enter the background and use the column administrator admin1 we created:

1

We click in order and grab packets:

2

3

There is a SQL blind injection vulnerability in the location of name:

4

5

POC:/admin/admin.php?name=s%"+and+"sca%"="&cat=0&status=&action=cms&ctrl=lists&submit=%E6%9F%A5%E8%AF%A2

taogogo commented 3 years ago

3.0.1 fixed, thanks for your contribution