SQL Injection Vulnerability in ImageCMS

High-Tech Bridge Security Research Lab discovered vulnerability in ImageCMS, which can be exploited to perform SQL injection attacks.

1. SQL injection vulnerability in ImageCMS: CVE-2012-6290
   The vulnerability exists due to insufficient filtration of the “q” HTTP GET parameter passed to “/admin/admin_search/”. A remote authenticated administrator can execute arbitrary SQL commands in the application’s database.
   Depending on the database and system configuration PoC (Proof-of-Concept) code below will create “/tmp/file.txt” file with MySQL server version inside:
   http://[host]/admin/admin_search?q=123%27%20UNION%20SELECT%201,2,version%28% 29,4,5,6,7,8,9,10,11,1 2,13,14,15%20INTO%20OUTFILE%27/tmp/file.txt%27%20–%202
   This vulnerability can also be exploited by remote non-authenticated attacker via CSRF vector because the application is prone to Cross-Site Request Forgery attack. In order to do so attacker should trick a logged-in administrator to visit a web page with CSRF exploit.
   Basic CSRF exploit example:
   <img src=“http://[host]/admin/admin_search?q=123%27%20UNION%20SELECT%201,2,versio n%28%29,4,5,6,7,8,9,10,11,1 2,13,14,15%20INTO%20OUTFILE%27/tmp/file.txt%27%20–%202”>