Jaow 2.4.5 – Blind SQL Injection - 体验盒子

作者： kallimero

日期： 2012-05-24

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/18921/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

# Exploit Title: Jaow <= 2.4.5 Blind Sql Injection

# Google Dork: intext:"propuls� par jaow 2.4.5"

# Date: 23/05/2012

# Software Link: http://www.jaow.net/telechargements/Jaow_V2.4.5.zip

# Version: 2.4.5

# Tested on: Debian GNU/Linux

# Author: kallimero

= Introduction =

Jaow is a CMS that can manage sites of small sizes, thanks to its simple,

commented code you can easily create templates and / or create modules to

suit your needs. Jaow is the solution for small sites, blogs or portfolio.

= Details =

Unfortunately, a Blind SQL injection is possible in the 2.4.5 core.

Vulnerable page : add_ons.php

Extract from the source :

-------------[ add_ons.php ]--------------

// On stocke dans une variable simple le add_on demand�

$add_on = stripslashes($_GET['add_ons']);

// On recherche si l'add_on est install�

echo 'SELECT id,nom FROM '.$db_prefix.'add_ons WHERE nom="'.$add_on.'"

AND actif="1"';

$query_add_ons = mysql_query('SELECT id,nom FROM '.$db_prefix.'add_ons

WHERE nom="'.$add_on.'" AND actif="1"');

-------------[ add_ons.php ]--------------

So, we can inject sql with the add_ons variable, like that :

http://[site]/[path]/add_ons.php?add_ons=[SQL injection]

= Solutions =

Update is avalaible here : http://www.jaow.net/Article-97

= Thanks =

Thanks tonecromoine, fr0g, st0rn, applestorm, Zhyar, k3nz0, m4ke and all

hwc-crew members. http://hwc-crew.com/

And all npn members. http://n-pn.info/