HexBrain

Concrete CMS · Report #4811

dashboard/pages/types [Unknown column 'Array' in 'where clause'] disclosure.

Validstatus
2upvotes
9 Jun 2014disclosed

How it was found

Hi,

When I go to /index.php/dashboard/pages/types?ctID[]=4&task=edit I get thrown the following : mysqlt error: [1054: Unknown column 'Array' in 'where clause'] in EXECUTE("SELECT PageTypes.ctID, ComposerTypes.ctID as ctIDc, ctHandle, ctIsInternal, ctName, ctIcon, pkgID, ctComposerPublishPageMethod, ctComposerPublishPageTypeID, ctComposerPublishPageParentID from PageTypes left join ComposerTypes on PageTypes.ctID = ComposerTypes.ctID where PageTypes.ctID = Array")

It's not a SQL Injection but it also shouldn't happen..

Best regards,

Olivier Beg

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original