127 lines
No EOL
3.7 KiB
Text
127 lines
No EOL
3.7 KiB
Text
# Exploit Title: Chipmunk Board (index.php?forumID) Remote SQL Injection Vulnerability
|
|
# Date: October, 01 st 2010
|
|
# Author: Shamus
|
|
# Software Link: http://www.chipmunk-scripts.com/board/board.zip
|
|
# Version: Chipmunk Forums Version 1.3
|
|
# Tested on: windows
|
|
# CVE : -
|
|
|
|
|
|
|
|
-----------------------------------------------------------------------------------------
|
|
Chipmunk Board 1.3 (index.php?forumID) Remote SQL Injection Vulnerability
|
|
-----------------------------------------------------------------------------------------
|
|
|
|
Author : Shamus
|
|
Date : October, 02 nd 2010 [GMT +7]
|
|
Location : Solo && Jogjakarta, Indonesia
|
|
Web : http://antijasakom.net/forum
|
|
Critical Lvl : moderate
|
|
Impact : Exposure of sensitive information
|
|
Where : From Remote
|
|
---------------------------------------------------------------------------
|
|
|
|
|
|
|
|
Affected software description:
|
|
~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
|
|
Application : Chipmunk Forums
|
|
version : Chipmunk Forums Version 1.3
|
|
Vendor : chipmunk-scripts
|
|
download : http://www.chipmunk-scripts.com/board/board.zip
|
|
Description :
|
|
Chipmunk Forum is a small yet flexible and fully featured forum system.
|
|
It has unlimited categories and forums, staff only forums, read only forums, 4 levels of permissions. S
|
|
milies, word filters, BBcode, Ip banning, e-mail ban from registration and much more.
|
|
--------------------------------------------------------------------------
|
|
|
|
|
|
|
|
Vulnerability:
|
|
~~~~~~~~~~~~
|
|
A weakness has been discovered in Chipmunk Board on which version to 1.3.
|
|
Where an attacker could exploit the gap that exists to obtain sensitive data within the database.
|
|
These vulnerabilities were identified in the path "index.php? forumID"
|
|
|
|
PoC/Exploit :
|
|
~~~~~~~~~~
|
|
injection type is integer, MSSQL with error
|
|
|
|
http://www.sitetarget.com/board/index.php?forumID=1[Injection query]
|
|
|
|
example of exploitation :
|
|
http://www.site.com/board/index.php?forumID=25[Injection query]
|
|
|
|
|
|
|
|
Dork:
|
|
~~~~~
|
|
Google : [think black, you can]
|
|
|
|
Solution:
|
|
~~~~~
|
|
- N/A.
|
|
|
|
|
|
Timeline:
|
|
~~~~~~~
|
|
|
|
- 01 - 10 - 2010 bug found
|
|
- 01 - 10 - 2010 vendor contacted
|
|
- 02 - 10 - 2010 advisory release
|
|
---------------------------------------------------------------------------
|
|
|
|
|
|
|
|
Shoutz:
|
|
~~~~~~~
|
|
|
|
oO0::::: Greetz and Thanks: :::::0Oo.
|
|
Tuhan YME
|
|
My Parents
|
|
SPYRO_KiD
|
|
K-159
|
|
lirva32
|
|
newbie_campuz
|
|
|
|
And Also My LuvLy :
|
|
..::.E.Z.R (The deepest Love I'v ever had..).::..
|
|
|
|
in memorial :
|
|
1. Monique
|
|
2. Dewi S.
|
|
3. W. Devi Amelia
|
|
4. S. Anna
|
|
|
|
oO0:::A hearthy handshake to: :::0Oo
|
|
~ Crack SKY Staff
|
|
~ Echo staff
|
|
~ antijasakom staff
|
|
~ jatimcrew staff
|
|
~ whitecyber staff
|
|
~ lumajangcrew staff
|
|
~ unix_dbuger, boys_rvn1609, jaqk, byz9991, bius, g4pt3k, anharku, wandi, 5yn_4ck, kiddies, bom2, untouch, antcode
|
|
~ arthemist, opt1lc, m_beben, gitulaw, luvrie, poniman_coy, ThePuzci, x-ace, newbie_z, petunia, jomblo.k, hourexs_paloer, cupucyber, kucinghitam, black_samuraixxx, ucrit_penyu, wendys182, cybermuttaqin
|
|
~ k3nz0, thomas_ipt2007, blackpaper, nakuragen, candra, dewa
|
|
~ whitehat, wenkhairu, Agoes_doubleb, diki, lumajangcrew a.k.a adwisatya a.k.a xyberbreaker, wahyu_antijasakom
|
|
~ Cruz3N, mywisdom,flyff666, gunslinger_, ketek, chaer.newbie, petimati, gonzhack, spykit, xtr0nic, N4ck0, assadotcom, Qrembiezs, d4y4x
|
|
~ All people in SMAN 3
|
|
~ All members of spyrozone
|
|
~ All members of echo
|
|
~ All members of newhack
|
|
~ All members of jatimcrew
|
|
~ All members of Anti-Jasakom
|
|
~ All members of whitecyber
|
|
~ All members of Devilzc0de
|
|
#e-c-h-o, #K-elektronik, #newhack, #Solohackerlink, #YF, #defacer, #manadocoding, #jatimcrew, #antijasakom, #whitecyber, #devilzc0de
|
|
---------------------------------------------------------------------------
|
|
|
|
|
|
|
|
Contact:
|
|
~~~~~~~~~
|
|
|
|
Shamus : Shamus@antijasakom.net
|
|
Homepage: https://antijasakom.net/forum/viewtopic.php?f=38&t=666
|
|
-------------------------------- [ EOF ] ---------------------------------- |