Secunia

Multiple vulnerabilities have been discovered in OneCMS, which can be exploited by malicious people to disclose sensitive information and conduct SQL injection attacks.

1) Input passed to the "load" parameter in install_mod.php (when "act" is set to "go") is not properly sanitised before being used to include files. This can be exploited to include arbitrary files from local resources with a HTTP client that does not follow redirects.

2) Input passed via the "user" parameter to index.php (when "load" is set to "elite") is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

Successful exploitation requires that "magic_quotes_gpc" is disabled.

The vulnerabilities are confirmed in version 2.5. Other versions may also be affected.

Solution
Vulnerability #1 has been fixed in version 2.6. Edit the source code to ensure that input is properly sanitised.

Provided and/or discovered by
1) Digital Security Research Group
2) .:[melkiy]:.

Changelog
Further details available in Customer Area

Original Advisory
Digital Security Research Group:
http://milw0rm.com/exploits/5669

.:[melkiy]:.:
http://www.exploit-db.com/exploits/11635

Deep Links
Links available in Customer Area