AS3FlexDB Database Login Information Disclosure & Remote SQL Excution

=====================================================================
AS3FlexDB Database Login Information Disclosure	& Remote SQL Excution
=====================================================================

$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$$	AS3FlexDB Database Login Information Disclosure	& Remote SQL Excution 			
$$$												
$$$				|| License:	Free						
$$$				|| Language:	English						
$$$	AS3FlexDB		|| Cost:	$0						
$$$				|| Platform:	Flash Player					
$$$				|| Demo: http://www.sephiroth.it/tutorials/flashPHP/as3flexdb/files/FlexDBExample.zip	
$$$												
$$$				|| Name: 	~Fyodor 		
$$$				|| WWW:		http://fyodor.co.cc					
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$

[$] Vulnz Description :
1/ Database Login Information Disclosure
AS3FlexDB project is a open source library that allows Adobe Flex applications to connect to a MySQL server. This library use AMFPHP to access a MySQL server.
AS3FlexDB let you write all your SQL's in FLEX and not in PHP. More exactly you can do almost every action on a table in FLEX without making new classes in PHP and access it.
When developer write FLEX app using AS3FlexDB, he must specify database login information in sourcecode (MXML), it will be compile to SWF when publish to internet. Yaa, we can say database login information is stored in SWF file, but anyone can decode this SWF file (using some Flash decode program, I'm using SWFDecompiler) and get this information !
For example, with their project example (http://www.sephiroth.it/tutorials/flashPHP/as3flexdb/files/FlexDBExample.zip), Open /FlexDBExample/bin-debug/FlexDBExample.swf with SWFDecompiler, you can see database login information:

public function _FlexDBExample_ConnectionData1_i() : ConnectionData
{
    var _loc_1:* = new ConnectionData();
    c1 = _loc_1;
    _loc_1.name = "mxml_conn1";
    _loc_1.host = "localhost";
    _loc_1.db = "test";
    _loc_1.username = "root";
    _loc_1.password = "root";
    return _loc_1;
}

As you can see, Database host is "localhost" with Username "root" and Password "root", Database name is "test"

2/ Remote SQL Excution 
But when developer ofuscator SWF file, we can get hard to know database login information. Ok, no problem, AS3FlexDB uses AMFPHP to send/receive data between Flash and PHP Backend, and, OMG, it allow query SQL command directly from Flash. It means we can use some TCP sniffer or just Connection sniffer (I recommend Firebug for Firebox) to get Gateway URL, when get the Gateway URL, we will emulate AMF request contain our SQL command and send to Gateway.





#  0day.today [2018-03-06]  #