RootPanel SQL Injection

`============================================================  
RootPanel (All versions) SQL injection/Account takeover.  
Discovery: AkaStep and CAMOUFL4G3  
Vendor: http://www.rootpanel.ru/  
============================================================  
What is RootPanel ?  
RootPanel is professional hosting billing system for your organisation and for your   
internet-business.  
It is usefull for hosting management things like:  
/vps/vds/servers and for automate domain registrations/server/hosting management   
and so on.  
============================================================  
Vulnerability details:  
0x30  
  
After looking into code we noticed that theris a lot fundamental dangerious some   
"implementations" exists.  
  
Fun begins with that developers didn't used mysql_real_escape_string() function.  
  
  
//_rootfuncs.php  
  
function htmlEncode($txt)  
{  
return htmlspecialchars($txt, ENT_QUOTES, "UTF-8");  
}  
  
  
So we can't use single quotes (') right?   
Because they will be converted to:   
  
' (single quote) =====> wil be converted to: '  
" (double quote) =====> will be converted to: "  
  
Also notice for first view we may think that we can't use backslash to break out an SQL query syntax and control it under our conditions.  
  
DO WE RIGHT ABOUT stripslashes() ?  
[ YES ] [ NO ] [ CANCEL ] [ VABSE DUR SIKDIR xD ]  
  
http://php.net/manual/en/function.stripslashes.php  
  
  
Here is what php manual says and does as needed:  
  
==================================  
  
  
Return Values  
  
Returns a string with backslashes stripped off. (\' becomes ' and so on.)   
Double backslashes (\\) are made into a single backslash (\).  
  
  
==================================  
  
  
So, as input we need pass double slashes ( \\ ) to gain access to an SQL query and correspondingly control it.  
  
  
  
0x31 Account Takeover  
  
  
No need to crack passwords...   
No need waste your machines and your gold time...  
  
  
Password retrieval functionality is your best Friend!  
Here is how we gained immediate access to accounts of lamers and owned all of them.  
  
  
//forgotpass.php  
//SNIP//  
//variable $nameemail is user input and it passed through htmlEncode() function.//  
  
if ($do == 'request') {  
if (!$nameemail) { $error = $_lang[ForgotErrorNameOrEmail]; $do='';}  
else {  
$r = @mysql_query("select * from users where login='$nameemail' or email='$nameemail'") or die("File: ".__FILE__."<BR>Line: ".__LINE__."<BR>MySQL Error: ".mysql_error());  
if (mysql_num_rows($r) > 0) {  
while ($rr = mysql_fetch_object($r))   
{$forgotkey=generatePassword(15);  
  
@mysql_query("update users set forgotkey='$forgotkey' where id='$rr->id'") or die("File: ".__FILE__."<BR>Line: ".__LINE__."<BR>MySQL Error: ".mysql_error());  
$tpl=GetTpl('email_touser_forgot_password',$rr->lang);  
$subject=$tpl[subject]; $template=$tpl[template];  
if ($subject and $template) {$company_name=GetSetting('company_name');  
$company_url=GetSetting('company_url');$support_email=GetSetting("support_email");  
$support_url=GetSetting('support_url');  
  
$subject = str_replace('{login}',$rr->login,$subject);  
$template = str_replace('{company_name}',$company_name,$template);  
$template = str_replace('{company_url}',$company_url,$template);  
$template = str_replace('{support_url}',$support_url,$template);  
$template = str_replace('{login}',$rr->login,$template);  
$template = str_replace('{link}',$full_www_path."forgotpass.php?fkey=$forgotkey",$template);  
  
// EOF SNIP //  
  
  
  
  
  
0x32 Exploitation:  
  
1 ) Whois interesting domain.Grab registrant mail addr.  
2 ) Using sql injection grab login field's data (ur choise you can fetch mail too)  
3 ) Travel to HOSTER.TLD/forgotpass.php and enter victim mail address.  
Once you've submit "SEND" button new token (aka reset token) will be generated for victim account .  
*Be carefull it also will be @mailed to victim mail address.*  
4 ) Using sql injection grab token from database for victim account.  
5 ) Travel to : HOSTER.TLD/forgotpass.php?fkey=APPEND_TOKEN_HERE  
6 ) Set new password for lamer's account and sign in using login and new generated password.  
7 ) Travel 1111  
  
Below is one of real exploitation examples:  
http://oi40.tinypic.com/2ceiwsp.jpg  
  
NOTE 1: Avoid using error based way. In most cases it may create powerfull Denial Of service against hoster.  
NOTE 2: Depending on software version column counts may vary.  
Fix? 0day!  
  
Anyways,Enjoy.  
  
  
Random() notes:  
0x6176616E65736F76 how are you baby? xD  
Ala besdi plagiatla mesgul olduz blet!  
  
  
  
  
=========================================  
KUDOSSSSSSS  
=========================================  
  
packetstormsecurity.org  
packetstormsecurity.com  
packetstormsecurity.net  
securityfocus.com  
cxsecurity.com  
security.nnov.ru  
securtiyvulns.com  
securitylab.ru  
secunia.com  
securityhome.eu  
exploitsdownload.com  
osvdb.com  
websecurity.com.ua  
1337day.com  
itsecuritysolutions.org  
waraxe.us  
exploit-db.com  
insecurety.net  
  
Special respect to CAMOUFL4G3 && and to all   
Azerbaijan Black hatz,Aa team && to All Turkish hackers.  
=========================================  
  
  
/AkaStep  
  
`