/ -[061124a]- | deV!L`z Clanportal - SQL Injection | / S Y N O P S I S / =================' -( access: remote severity: high )- An SQL injection has been found in deV!L`z Clanportal, which allows any logged in user to grant herself admin privileges in the system. B A C K G R O U N D / =====================' deV!L`z Clanportal (short "DZCP") is a suite of PHP scripts that allow anybody to create a feature-rich website for her online gaming clan. A F F E C T E D V E R S I O N S / ===================================' verified on: 1.3.6 possibly vulnerable: <= 1.3.6 fixed in: 1.3.6.1 I M P A C T / =============' The attacker gains admin privileges in DZCP and is thus able to create and download a MySQL dump, upload files, post news, delete users etc. P R E R E Q U I S I T I E S / =============================' o the attacker needs to have an user account in the suite and be logged in o php.ini directive "magic_quotes_gpc" has to be disabled D E S C R I P T I O N / =======================' sites/index.php is not escaping the $_GET['show'] parameter, leading to an SQL injection. This can be used to pass any string to the $where parameter in DZCP's page() function. page(), in turn, is not checking that parameter, allowing a second SQL injection in an UPDATE statement on the "users" table to change arbitrary attributes in the calling user's tuple, including the "level" attribute, which, set to 4, grants the user administrator privileges. W O R K A R O U N D / =====================' Some possibilities: o Add a mysql_real_escape_string() around the $_GET parameter in the SQL query in sites/index.php. o Remove sites/index.php or make it inaccessible. o Quit using DZCP. I mean it! There are tons of other vulnerabilites just waiting to be exploited; some of them more severe than this one. IMHO, DZCP is just a chaotic bunch of vulnerabilities that, by some coincidence, happen to look like a clan portal. P R O O F O F C O N C E P T / =================================' Check if magic_quotes_gpc is enabled: http://<dzcp>/sites/index.php?show=' If a MySQL error appears or the script dies, it is disabled. Then: http://<dzcp>/sites/index.php?show=-1'+%55NION+%53ELECT+1,+'Admin+Panel ',+level%3d4,+waffe%3d'SQL+Injection',+2,+3,+' T I M E L I N E (CET) / ========================' 2006-11-23 23:05 started searching 24 0:35 exploited 14:20 advisory finished 17:31 informed vendor that any user can get admin privileges 25 23:00 full disclosure to vendor 27 14:36 hotfix available on vendor website 12-01 10:00 full disclosure to the general public A B O U T T H E A U T H O R / =================================' Tim Weber, computer science student at the University of Mannheim, Germany, currently looking for an internship at some IT security or pentesting company, can be reached via e-mail: scy-adv-061124a at the host scytale.de. T H A N K S / =============' o Kallista o yorn for showing me DZCP and the basics of SQL injections o the DZCP authors for the fun in secure.php