Advisory: SQL injection vulnerabilities in zerocms <= v.1.3.3
Advisory ID: SROEADV-2015-13
Author: Steffen Rösemann
Affected Software: zerocms <= v.1.3.3 (released 23rd-Jan-2015)
Vendor URL:
Vendor Status: platform will be moving to Rails4

Vulnerability Description:

Content management system Zerocms v. 1.3.3 suffers from SQL injection

Technical Details:

The article_id-parameter used in zero_view_article.php is vulnerable to SQL
injection. It is located here in a common Zerocms-installation and can be
exploited even by unregistered users:




A Blind SQL injection vulnerability can be found the file
zero_user_transact.php. The parameter user_id is vulnerable to SQL
injection. See the following example POST-request which serves as

POST /views/zero_transact_user.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:35.0)
Gecko/20100101 Firefox/35.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: de,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Referer: http://{TARGET}/views/zero_user_account.php?user_id=2
Cookie: PHPSESSID=rirftt07h0dem8d48lujliuve6
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 91

name=user& AND

The Blind SQL injection vulnerability can be exploited on the
administrative backend of Zerocms.

The vulnerabilities described above have been tested on the following
versions of Zerocms:

- v. 1.3.2
- v. 1.3.3


Vendor seems not to provide a patch for this vulnerabilities as version
1.3.3 is the last release for this PHP-based platform. It will be developed
on the Rails4-platform in future releases (see Github repository, release

Disclosure Timeline:
23-Jan-2015 – found the vulnerabilities in v.1.3.2
23-Jan-2015 - informed the developers (see [3])
23-Jan-2015 – release date of this security advisory [without technical
23-Jan-2015 - forked the vulnerable version to keep it available for other
researchers (see [4])
23-Jan-2015 - developer released v.1.3.3 of zerocms
24-Jan-2015 - vulnerabilities can also be found in v.1.3.3
29-Jan-2015 - as vendor will move the platform to Rails4, it seems that
there will be no patch provided (see [5])
29-Jan-2015 - release date of this security advisory
29-Jan-2015 - send to FullDisclosure


Vulnerability found and advisory written by Steffen Rösemann.



Sent through the Full Disclosure mailing list
Web Archives & RSS:

Reply via email to