Multiple vulnerabilities have been reported in Lasernet CMS, which can be exploited by malicious people to conduct SQL injection attacks and compromise a vulnerable system.

1) Input passed to the "new" parameter in index.php (when "id" is set to "new") is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

Successful exploitation requires that "magic_quotes_gpc" is disabled.

2) A vulnerability is caused due to an error related to FCKEditor. This can be exploited to e.g. upload malicious files and execute arbitrary PHP code.

This may be related to:
SA27123

Successful exploitation requires that the uploader is enabled.

These vulnerabilities are confirmed in version 1.11 and reported in version 1.5. Other versions may also be affected.

3) Input passed via the "id" parameter to index.php is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

This vulnerability is reported in version 1.5. Other versions may also be affected.

Solution
Edit the source code to ensure that input is properly sanitised. Disable the file upload functionality.

Provided and/or discovered by
1) cO2
2) t0pP8uZz
3) p0pc0rn

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://milw0rm.com/exploits/5454
http://milw0rm.com/exploits/5886

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers