SQL injection vulnerability in Pragyan CMS v.3

Dear developer team.

Yesterday, I found a SQL injection vulnerability in the current release of Pragyan CMS v.3.

If you are interested about the information, please provide me an email address, where I can send my informations to. If you want me to post the information directly on Github, please let me know.

I located the vulnerability in the code, too, and could suggest a patch for this issue, if you are interested.

I am releasing a security advisory on my blog (without technical details, see: http://sroesemann.blogspot.de/2015/01/sroeadv-2015-11.html). If you are not responding until 2nd February 2015 (UTC+1) I am gonna release the technical details as well and post the issue to the security mailing list FullDisclosure.

Thank you for your attention.

Greetings from Germany.

Steffen Rösemann

[vshriram93]

Hi Steffen Rösemann,
Thanks for reaching to us. Would be good, if you could mail the vulnerability to vshriram93@gmail.com ?
Thanks,
Shriram

Hi Shriram.

Just have sent you the technical details, including my suggestion for a patch and the screenshot to the above mentioned email address.

Thank you very much.

Greetings.

Steffen Rösemann

Dear Shriram.

Its been 12 days since my initial report for this issue.

Are there any news on patching these vulnerabilities?

Greetings.

Steffen

Details public here: http://seclists.org/fulldisclosure/2015/Feb/18

This issue has been assigned CVE-2015-1471.

See http://seclists.org/oss-sec/2015/q1/402.