The host is installed with Concrete CMS and is prone to sql injection vulnerability

Successful exploitation will allow remote attackers to execute arbitrary SQL commands in applications database and gain complete control over the vulnerable web application. Impact Level: Application

Upgrade to version 5.6.3 or later, For updates refer to https://www.concrete5.org

The flaw is due to improper validation of 'cID' parameter passed to '/index.php' script.

Concrete CMS version 5.6.2.1

Send a crafted exploit string via HTTP GET request and check whether it is possible to execute sql query.

• http://1337day.com/exploit/21919
• http://packetstormsecurity.com/files/125280/concrete5-sql.txt
• http://www.exploit-db.com/exploits/31735/

---

Updated on 2015-03-25