XOOPS 2.5.9 - SQL Injection

Author: felipe andrian
type: webapps
platform: php
port: 80.0
date_added: 2019-05-13 
date_updated: 2019-05-13 
verified: 0 
codes:  
tags: SQL Injection (SQLi)
aliases:  
screenshot_url:  
application_url: http://www.exploit-db.comxoops-2.5.9.tgz

[+] Sql Injection on XOOPS CMS v.2.5.9

[+] Date: 12/05/2019

[+] Risk: High

[+] CWE Number : CWE-89

[+] Author: Felipe Andrian Peixoto

[+] Vendor Homepage: https://xoops.org/

[+] Contact: felipe_andrian@hotmail.com

[+] Tested on: Windows 7 and Gnu/Linux

[+] Dork: inurl:gerar_pdf.php inurl:modules // use your brain ;)

[+] Exploit :

        http://host/patch/modules/patch/gerar_pdf.php?cid= [SQL Injection]


[+] EOF