The host is installed with Digital Craft AtomCMS and is prone to file upload and sql injection vulnerabilities.

Successful exploitation will allow attacker to gain unauthorized privileges and manipulate SQL queries in the backend database allowing for the manipulation or disclosure of arbitrary data. Impact Level: Application

No solution or patch is available as of 9th February, 2015. Information regarding this issue will be updated once the solution details are available. or updates refer to https://github.com/thedigicraft/Atom.CMS

Input passed via the 'id' parameter to /admin/uploads.php script is not properly sanitised before being used.

Digital Craft AtomCMS version 2.0

Send a crafted data via HTTP GET request and check whether it is able execute sql query or not.

• http://packetstormsecurity.com/files/127371
• http://www.osvdb.com/108788

---

Updated on 2015-03-25