DaLogin Multiple Vulnerabilities

🗓️ 01 Jul 2014 00:00:00Reported by RootType

Security vulnerabilities in dalogin 2.2 PHP + Mysql app with config file disclosure, SQL injection, and XS


                                                dalogin 2.2 multiple vulnerabilites
app desc: Configurable WebSite. PHP + Mysql: news zone with rss feed,
private zone, languages, themes, administration panel
app source: http://dalogin.sourceforge.net/
author: hc0

[1] config file disclosure
you can access config.ini file from [path]/admin/include/config.ini
this file contains mysql connection informations (user, pass, host etc..)
its says &#34;come here and ownz by box!!&#34;

[2] sql injection
at line 115 requested http parameter id use in sql query without filtering.

114 - //LEER COMENTARIOS
115 - $Sql=&#34;SELECT * from news_comments WHERE id_new=&#34;.$_REQUEST[&#39;id&#39;].&#34;
AND state=1&#34;;
116 - $result_comments = mysql_query($Sql);
117 - while ($row_comments=mysql_fetch_array($result_comments))
118 - {
119 - echo &#39;&#60;table class=&#34;CommentTable&#34;&#62;&#39;;
120 - echo &#39;&#60;tr&#62;
121 - &#60;td
width=&#34;100px&#34;&#62;&#39;.strftime(DATE_TIME_FORMAT,strtotime($row_comments[&#39;date_comment&#39;])).&#39;

122 - &#60;br /&#62;&#60;b&#62;&#39;.$row_comments[&#39;user_name&#39;].&#39;&#60;/b&#62;
123 - &#60;/td&#62;
124 - &#60;td class=&#34;CommentTableImg&#34;&#62;
125 - &#39;.$row_comments[&#39;comment&#39;].&#39;
126 - &#60;/td&#62;
127 - &#60;/tr&#62;&#39;;
128 - echo &#39;&#60;/table&#62;&#60;br /&#62;&#39;;
129 - }

[3] xss

181 - function InsertComment()
182 - {
183 - global $link;
184 - $Sql=&#34;INSERT INTO news_comments
(id_new,comment,date_comment,state,user_name) VALUES
(&#34;.$_REQUEST[&#39;id&#39;].&#34;,&#39;&#34;.$_POST[&#39;comment_text&#39;].&#34;&#39;,Now(),0,&#39;&#34;.$_POST[&#39;comment_user&#39;].&#34;&#39;)&#34;;

185 - mysql_query($Sql);
186 - echo &#39;&#60;div class=&#34;CommentAlert&#34; style=&#34; background-color:
#c5fbcd&#34;&#62;&#39;.COMMENT_SENT_LABEL.&#39;&#60;/div&#62;&#39;;
187 - }

you need post a comment that includes your xss attack payload and its saved
database. its so simple :)

[4] just for fun i&#39;m so bored..................

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1