HYSA-2006-003.txt

`------------------------------------------------------  
HYSA-2006-003 h4cky0u.org Advisory 012  
------------------------------------------------------  
Date - Thu Feb 24 2006  
  
  
TITLE:  
======  
  
Oi! Email Marketing 3.0 SQL Injection  
  
  
SEVERITY:  
=========  
  
High  
  
  
SOFTWARE:  
=========  
  
Oi! Email Marketing 3.0. Prior versions maybe affected  
  
  
INFO:  
=====  
  
Oi Email Marketing System is a Linux compatible application that can be a stand-alone product or can be integrated into Mambo 2002 content management system. It uses a powerful database which resides on your webserver and allows complete control over all your subscribers, campaigns and emails.  
  
Support Website : www.miro.com.au  
  
  
DESCRIPTION:  
============  
  
Oi Email Marketing System is prone to an SQL injection vulnerability. This issue is due to a failure in the index.php script of the application to properly sanitize user-supplied input before using it in SQL queries.  
  
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.  
  
  
POC:  
====  
  
First go to http://www.site.com/oi/index.php  
  
In this login page provide the following inputs:  
  
Username : username' OR '   
  
Password : ' OR '  
  
Note : here username should be a valid user registered on the site (generally admin)  
  
Also, if a 'superadministrator'login is found and sucessfully exploited the server's   
ftp password can be found by clicking 'Configuration' and viewing the pages source:   
  
(It's hidden by *)   
  
<TD CLASS="dialogue_heading">Password</TD>   
<TD><input type="password" name="ftpPassword" value="password"></TD>  
  
  
VENDOR STATUS  
=============  
  
Vendor was contacted repeatedly but no response received till date.  
  
  
FIX:  
====  
  
No fix available as of date.  
  
  
CREDITS:  
========  
  
- This vulnerability was discovered and researched by -  
  
Illuminatus of h4cky0u Security Forums.  
  
Mail : illuminatus85 at gmail dot com  
  
Web : http://www.h4cky0u.org  
  
  
- Co Researcher -  
  
h4cky0u of h4cky0u Security Forums.  
  
Mail : h4cky0u at gmail dot com  
  
Web : http://www.h4cky0u.org  
  
  
ORIGINAL ADVISORY:   
==================   
  
http://www.h4cky0u.org/advisories/HYSA-2006-003-oi-email.txt   
  
  
--   
http://www.h4cky0u.org   
(In)Security at its best...   
`